diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index 0b101b66c7..55cbd2377c 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -41,7 +41,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - security_domain: endpoint required_fields: - _time - Processes.process_name @@ -51,4 +50,5 @@ tags: - Processes.parent_process - Processes.process_name - Processes.process_id - - Processes.parent_process_id \ No newline at end of file + - Processes.parent_process_id + security_domain: endpoint diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index b1b4202ac0..9b335941a7 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -43,7 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - security_domain: endpoint required_fields: - _time - Processes.process_name @@ -53,4 +52,5 @@ tags: - Processes.parent_process - Processes.process_name - Processes.process_id - - Processes.parent_process_id \ No newline at end of file + - Processes.parent_process_id + security_domain: endpoint diff --git a/detections/endpoint/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml index 5ee8a925ef..02658570ca 100644 --- a/detections/endpoint/detect_mimikatz_using_loaded_images.yml +++ b/detections/endpoint/detect_mimikatz_using_loaded_images.yml @@ -30,9 +30,12 @@ tags: - Detect Zerologon Attack - Cloud Federated Credential Abuse asset_type: Windows + automated_detection_testing: passed cis20: - CIS 6 - CIS 8 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log kill_chain_phases: - Actions on Objectives mitre_attack_id: @@ -52,6 +55,3 @@ tags: - Computer - Image security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml index 93edaffde7..34972cca41 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/endpoint/detect_mshta_renamed.yml @@ -28,6 +28,7 @@ tags: analytic_story: - Suspicious MSHTA Activity asset_type: Endpoint + automated_detection_testing: passed cis20: - CIS 8 dataset: @@ -54,4 +55,3 @@ tags: - process_path - CommandLine security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml index 858e19dd19..b330ccef74 100644 --- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml @@ -11,8 +11,8 @@ description: 'The detection Detect Path Interception By Creation Of program exe privilege escalation. ' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe - by Processes.user Processes.process_name Processes.process Processes.dest - | `drop_dm_object_name(Processes)` | rex field=process "^.*?\\\\(?[^\\\\]*\.(?:exe|bat|com|ps1))" + by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` + | rex field=process "^.*?\\\\(?[^\\\\]*\.(?:exe|bat|com|ps1))" | eval process_name = lower(process_name) | eval service_process = lower(service_process) | where process_name != service_process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_path_interception_by_creation_of_program_exe_filter`' diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 44bf6fb1f5..254a89981b 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -41,11 +41,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - security_domain: endpoint required_fields: - _time - Registry.registry_key_name - Registry.registry_path - Registry.user - Registry.dest - - Registry.registry_value_name \ No newline at end of file + - Registry.registry_value_name + security_domain: endpoint diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml index 75aa255280..fa26c3851e 100644 --- a/detections/endpoint/fodhelper_uac_bypass.yml +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -50,7 +50,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - security_domain: endpoint required_fields: - _time - Processes.parent_process_name @@ -61,3 +60,4 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id + security_domain: endpoint diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml index 7ae48ef35d..310b725e43 100644 --- a/detections/endpoint/nishang_powershelltcponeline.yml +++ b/detections/endpoint/nishang_powershelltcponeline.yml @@ -43,7 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - security_domain: endpoint required_fields: - _time - Processes.process_name @@ -53,4 +52,5 @@ tags: - Processes.parent_process - Processes.process_name - Processes.process_id - - Processes.parent_process_id \ No newline at end of file + - Processes.parent_process_id + security_domain: endpoint diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml index e06b51dfe5..02dda88cfa 100644 --- a/detections/endpoint/ryuk_wake_on_lan_command.yml +++ b/detections/endpoint/ryuk_wake_on_lan_command.yml @@ -32,6 +32,7 @@ references: tags: analytic_story: - Ryuk Ransomware + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/ryuk/windows-sysmon.log kill_chain_phases: @@ -43,8 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - security_domain: endpoint - automated_detection_testing: passed required_fields: - _time - Processes.process @@ -55,4 +54,4 @@ tags: - Processes.process - Processes.process_id - Processes.parent_process_id - + security_domain: endpoint diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml index 1e23fa4153..626f2f6d8d 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml @@ -26,7 +26,7 @@ references: - https://adsecurity.org/?p=1275 tags: analytic_story: - - Credential Dumping + - Credential Dumping asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml index 963a265bf8..b46488ac07 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml @@ -28,7 +28,7 @@ references: - https://github.com/PowerShellMafia/PowerSploit tags: analytic_story: - - Credential Dumping + - Credential Dumping asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml index ac791a6cf3..dbe70d50fd 100644 --- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml @@ -23,7 +23,7 @@ references: - https://github.com/MichaelGrafnetter/DSInternals tags: analytic_story: - - Credential Dumping + - Credential Dumping asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml index a6d2730dd1..f39a129456 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml @@ -34,8 +34,8 @@ references: - https://github.com/MichaelGrafnetter/DSInternals tags: analytic_story: - - Credential Dumping - - Malicious PowerShell + - Credential Dumping + - Malicious PowerShell asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml index d3f0500b51..e0cdc47741 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml @@ -35,8 +35,8 @@ references: - https://github.com/MichaelGrafnetter/DSInternals tags: analytic_story: - - Credential Dumping - - Malicious PowerShell + - Credential Dumping + - Malicious PowerShell asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml index 2f5e7fd457..bfd3e469a9 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml @@ -31,8 +31,8 @@ known_false_positives: None identified. references: [] tags: analytic_story: - - Unusual Processes - - Credential Dumping + - Unusual Processes + - Credential Dumping asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml index 07f1ebdfd0..8e8954cfe6 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml @@ -29,8 +29,8 @@ known_false_positives: None identified. references: [] tags: analytic_story: - - Unusual Processes - - Credential Dumping + - Unusual Processes + - Credential Dumping asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml index 8cef206729..0e629fef08 100644 --- a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml +++ b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml @@ -27,8 +27,8 @@ known_false_positives: None identified. references: [] tags: analytic_story: - - Credential Dumping - - Malicious PowerShell + - Credential Dumping + - Malicious PowerShell asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml index 1f0cb6e6f3..e463d492ca 100644 --- a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml +++ b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml @@ -25,7 +25,7 @@ known_false_positives: None identified. references: [] tags: analytic_story: - - Credential Dumping + - Credential Dumping asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml index 5da09d9975..073efb1316 100644 --- a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml @@ -30,8 +30,8 @@ references: - https://github.com/gentilkiwi/mimikatz tags: analytic_story: - - Credential Dumping - - Unusual Processes + - Credential Dumping + - Unusual Processes asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml index 8c9f8eaef1..39ed49f993 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml @@ -34,8 +34,8 @@ references: - https://medium.com/@clermont1050/covid-19-cyber-infection-c615ead7c29 tags: analytic_story: - - Credential Dumping - - Unusual Processes + - Credential Dumping + - Unusual Processes asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml index 5623c57620..e594fd1016 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml @@ -30,8 +30,8 @@ known_false_positives: Although unlikely, using debuggers this way may be indica references: [] tags: analytic_story: - - Credential Dumping - - Unusual Processes + - Credential Dumping + - Unusual Processes asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml index 282d265440..903c507191 100644 --- a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml @@ -31,8 +31,8 @@ references: - https://github.com/PowerShellMafia/PowerSploit tags: analytic_story: - - Credential Dumping - - Malicious PowerShell + - Credential Dumping + - Malicious PowerShell asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___detect_pass_hash.yml b/detections/endpoint/ssa___detect_pass_hash.yml index e020e8e71d..38a964792b 100644 --- a/detections/endpoint/ssa___detect_pass_hash.yml +++ b/detections/endpoint/ssa___detect_pass_hash.yml @@ -24,7 +24,7 @@ references: - Initial ESCU implementation by Bhavin Patel and Patrick Bareiss tags: analytic_story: - - Lateral Movement + - Lateral Movement cis20: - CIS 3 - CIS 5 diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml index 8a904421ad..f8cb1c782f 100644 --- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml +++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml @@ -32,7 +32,7 @@ known_false_positives: Legitimate programs can also use command-line arguments t references: [] tags: analytic_story: - - Unusual Processes + - Unusual Processes cis20: - CIS 3 - CIS 8 diff --git a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml index 5580c62c12..b23cb13899 100644 --- a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml @@ -28,7 +28,7 @@ references: - https://github.com/PowerShellMafia/PowerSploit tags: analytic_story: - - Malicious PowerShell + - Malicious PowerShell asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml index 269743b401..e155f32dae 100644 --- a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml @@ -23,7 +23,7 @@ references: - https://github.com/PowerShellMafia/PowerSploit tags: analytic_story: - - Windows Persistence Techniques + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml index 67cc8de51e..9b47389a48 100644 --- a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml @@ -24,7 +24,7 @@ references: - https://github.com/MichaelGrafnetter/DSInternals tags: analytic_story: - - Windows Persistence Techniques + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml index 4e7cb685d2..369c80d9d4 100644 --- a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml @@ -24,7 +24,7 @@ references: - https://github.com/gentilkiwi/mimikatz tags: analytic_story: - - Windows Log Manipulation + - Windows Log Manipulation asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml index e098909b48..bb2dd5d0a2 100644 --- a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml @@ -26,7 +26,7 @@ references: - https://github.com/MichaelGrafnetter/DSInternals tags: analytic_story: - - Windows Persistence Techniques + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml index da936961b2..f65135d78f 100644 --- a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml @@ -27,7 +27,7 @@ references: - https://github.com/PowerShellMafia/PowerSploit tags: analytic_story: - - Windows Persistence Techniques + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml index 8a1f6efa4f..8108b8b310 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml @@ -27,8 +27,8 @@ references: - https://github.com/PowerShellMafia/PowerSploit tags: analytic_story: - - Malicious PowerShell - - Windows Persistence Techniques + - Malicious PowerShell + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml index f8866fe4e3..d61a2adc6a 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml @@ -24,7 +24,7 @@ references: - https://github.com/gentilkiwi/mimikatz tags: analytic_story: - - Windows Privilege Escalation + - Windows Privilege Escalation asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml index 6f65269372..baab480bfc 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml @@ -27,7 +27,7 @@ references: - https://github.com/gentilkiwi/mimikatz tags: analytic_story: - - Windows Service Abuse + - Windows Service Abuse asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml index bcf8a79093..f8c7d76cbe 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml @@ -35,8 +35,8 @@ references: - https://github.com/PowerShellMafia/PowerSploit tags: analytic_story: - - Windows Service Abuse - - Malicious PowerShell + - Windows Service Abuse + - Malicious PowerShell asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml index 78d8fe4cca..3700b2cb20 100644 --- a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml @@ -25,7 +25,7 @@ references: - https://github.com/PowerShellMafia/PowerSploit tags: analytic_story: - - Windows Privilege Escalation + - Windows Privilege Escalation asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index be323b6aed..326351c8fd 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -33,10 +33,10 @@ known_false_positives: There are circumstances where an application may legitima references: [] tags: analytic_story: - - Suspicious Command-Line Executions - - Suspicious MSHTA Activity - - Suspicious Zoom Child Processes - - Sunburst Malware + - Suspicious Command-Line Executions + - Suspicious MSHTA Activity + - Suspicious Zoom Child Processes + - Sunburst Malware cis20: - CIS 8 kill_chain_phases: diff --git a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml index c06bf90ffe..016e7518ad 100644 --- a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml +++ b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml @@ -57,7 +57,7 @@ known_false_positives: 'Some custom tools used by admins could be used rarely to references: [] tags: analytic_story: - - Unusual Processes + - Unusual Processes cis20: - CIS 8 kill_chain_phases: diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml index ccd1366fc5..f5461c3ad2 100644 --- a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml @@ -36,7 +36,7 @@ references: - https://github.com/PowerShellMafia/PowerSploit tags: analytic_story: - - Windows Discovery Techniques + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml index e4909636d9..8b107682ee 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml @@ -45,7 +45,7 @@ references: - https://github.com/PowerShellMafia/PowerSploit tags: analytic_story: - - Windows Discovery Techniques + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml index bc2414280b..81a8dc6ed8 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml @@ -24,7 +24,7 @@ references: - https://github.com/gentilkiwi/mimikatz tags: analytic_story: - - Windows Discovery Techniques + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml index 5a1dc87a99..a37df70ef5 100644 --- a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml @@ -35,7 +35,7 @@ references: - https://github.com/PowerShellMafia/PowerSploit tags: analytic_story: - - Windows Discovery Techniques + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml index c4965bde6d..f827535b25 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml @@ -28,7 +28,7 @@ references: - https://github.com/PowerShellMafia/PowerSploit tags: analytic_story: - - Windows Discovery Techniques + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml index 524c41dbee..71e691f385 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml @@ -23,7 +23,7 @@ references: - https://github.com/gentilkiwi/mimikatz tags: analytic_story: - - Windows Discovery Techniques + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml index c38b8ec4f4..084679d2ab 100644 --- a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml @@ -30,7 +30,7 @@ references: - https://github.com/PowerShellMafia/PowerSploit tags: analytic_story: - - Windows Discovery Techniques + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml index 52b742344c..d039836be7 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml @@ -23,7 +23,7 @@ references: - https://github.com/gentilkiwi/mimikatz tags: analytic_story: - - Windows Discovery Techniques + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml index 440b14a3fc..39ef845c57 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml @@ -28,7 +28,7 @@ references: - https://github.com/PowerShellMafia/PowerSploit tags: analytic_story: - - Windows Discovery Techniques + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml index f5ec31ffd3..16435f02e7 100644 --- a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml @@ -29,7 +29,7 @@ references: - https://github.com/PowerShellMafia/PowerSploit tags: analytic_story: - - Windows Discovery Techniques + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml index 59ca2ded68..a2d4017ed8 100644 --- a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml @@ -26,7 +26,7 @@ references: - https://github.com/gentilkiwi/mimikatz tags: analytic_story: - - Windows Discovery Techniques + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml index cbf2f7434a..3432c79c22 100644 --- a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml @@ -23,7 +23,7 @@ references: - https://github.com/PowerShellMafia/PowerSploit tags: analytic_story: - - Windows Discovery Techniques + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml index 4d02192a44..7d0c01fb62 100644 --- a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml @@ -23,7 +23,7 @@ references: - https://github.com/PowerShellMafia/PowerSploit tags: analytic_story: - - Windows Discovery Techniques + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml index 44341325ec..03fd3bc05c 100644 --- a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml @@ -28,7 +28,7 @@ references: - https://en.wikipedia.org/wiki/Microsoft_Detours tags: analytic_story: - - Windows Discovery Techniques + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml index af50324fcb..7110b56bcd 100644 --- a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml @@ -24,7 +24,7 @@ references: - https://github.com/gentilkiwi/mimikatz tags: analytic_story: - - Windows Discovery Techniques + - Windows Discovery Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml index 6efa006092..0444fb79cd 100644 --- a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml @@ -29,7 +29,7 @@ references: - https://github.com/MichaelGrafnetter/DSInternals tags: analytic_story: - - Windows Persistence Techniques + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml index 24a53a89d5..2c0b61d20f 100644 --- a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml @@ -24,7 +24,7 @@ references: - https://github.com/gentilkiwi/mimikatz tags: analytic_story: - - Windows Persistence Techniques + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml index 75c22c3bb5..12451fc57b 100644 --- a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml @@ -23,7 +23,7 @@ references: - https://github.com/PowerShellMafia/PowerSploit tags: analytic_story: - - Windows Persistence Techniques + - Windows Persistence Techniques asset_type: Windows cis20: - CIS 16 diff --git a/detections/endpoint/ssa___system_process_running_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_unexpected_location.yml index c1643f6dbd..850be641ba 100644 --- a/detections/endpoint/ssa___system_process_running_unexpected_location.yml +++ b/detections/endpoint/ssa___system_process_running_unexpected_location.yml @@ -232,7 +232,7 @@ known_false_positives: None references: [] tags: analytic_story: - - Windows Defense Evasion Tactics + - Windows Defense Evasion Tactics cis20: - CIS 8 kill_chain_phases: diff --git a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml index d273cdbfd8..10492272bf 100644 --- a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml +++ b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml @@ -51,7 +51,7 @@ references: - https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries tags: analytic_story: - - Unusual Processes + - Unusual Processes cis20: - CIS 8 kill_chain_phases: diff --git a/detections/endpoint/ssa___unusually_long_command_line.yml b/detections/endpoint/ssa___unusually_long_command_line.yml index 867cb6abcb..b04eb0be4a 100644 --- a/detections/endpoint/ssa___unusually_long_command_line.yml +++ b/detections/endpoint/ssa___unusually_long_command_line.yml @@ -34,7 +34,7 @@ known_false_positives: This detection may flag suspiciously long command lines w references: [] tags: analytic_story: - - Unusual Processes + - Unusual Processes cis20: - CIS 8 kill_chain_phases: diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml index 64385dc431..076b4a3321 100644 --- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml @@ -39,7 +39,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - security_domain: endpoint required_fields: - _time - EventID @@ -51,3 +50,4 @@ tags: - ParentImage - ParentCommandLine - process_path + security_domain: endpoint diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml index b2e29f2172..40edcae0eb 100644 --- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml @@ -39,7 +39,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - security_domain: endpoint required_fields: - _time - EventID @@ -51,3 +50,4 @@ tags: - ParentImage - ParentCommandLine - process_path + security_domain: endpoint diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index d22fd3f2f2..fe8a5c3407 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -43,7 +43,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - security_domain: endpoint required_fields: - _time - Processes.process_name @@ -53,4 +52,5 @@ tags: - Processes.parent_process - Processes.process_name - Processes.process_id - - Processes.parent_process_id \ No newline at end of file + - Processes.parent_process_id + security_domain: endpoint diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml index 741098d141..db76d6d087 100644 --- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml @@ -39,7 +39,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - security_domain: endpoint required_fields: - _time - EventID @@ -50,4 +49,5 @@ tags: - User - ParentImage - ParentCommandLine - - process_path \ No newline at end of file + - process_path + security_domain: endpoint diff --git a/detections/endpoint/unified_messaging_service_spawning_a_process.yml b/detections/endpoint/unified_messaging_service_spawning_a_process.yml index e0f00bf3ed..aac1555177 100644 --- a/detections/endpoint/unified_messaging_service_spawning_a_process.yml +++ b/detections/endpoint/unified_messaging_service_spawning_a_process.yml @@ -35,6 +35,7 @@ references: tags: analytic_story: - HAFNIUM Group + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_umservices.log kill_chain_phases: @@ -45,7 +46,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - security_domain: endpoint required_fields: - _time - Processes.process_name @@ -55,4 +55,4 @@ tags: - Processes.parent_process - Processes.process_id - Processes.parent_process_id - automated_detection_testing: passed + security_domain: endpoint diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml index fbc5bcdc30..463906186f 100644 --- a/detections/endpoint/w3wp_spawning_shell.yml +++ b/detections/endpoint/w3wp_spawning_shell.yml @@ -31,6 +31,7 @@ references: tags: analytic_story: - HAFNIUM Group + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon.log kill_chain_phases: @@ -41,7 +42,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - security_domain: endpoint required_fields: - _time - Processes.process_name @@ -49,4 +49,4 @@ tags: - Processes.dest - Processes.user - Processes.parent_process - automated_detection_testing: passed + security_domain: endpoint diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index 97ffdf278f..6ff621fcbd 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -7,10 +7,10 @@ type: batch datamodel: [] description: This search looks for Windows events that indicate one of the Windows event logs has been purged. -search: '(`wineventlog_security` (EventCode=1102 OR EventCode=1100)) OR (`wineventlog_system` +search: (`wineventlog_security` (EventCode=1102 OR EventCode=1100)) OR (`wineventlog_system` EventCode=104) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_event_log_cleared_filter`' + | `windows_event_log_cleared_filter` how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. known_false_positives: It is possible that these logs may be legitimately cleared diff --git a/detections/experimental/cloud/detect_gcp_storage_access_from_a_new_ip.yml b/detections/experimental/cloud/detect_gcp_storage_access_from_a_new_ip.yml index 9d81174150..a2a38b2fc3 100644 --- a/detections/experimental/cloud/detect_gcp_storage_access_from_a_new_ip.yml +++ b/detections/experimental/cloud/detect_gcp_storage_access_from_a_new_ip.yml @@ -58,7 +58,7 @@ tags: - _time - sc_status_ - cs_object_ - - c_ip_ + - c_ip_ - cs_uri_ - cs_method_ security_domain: network diff --git a/detections/experimental/endpoint/detect_exchange_web_shell.yml b/detections/experimental/endpoint/detect_exchange_web_shell.yml index ecaff7c803..1b0a5db71d 100644 --- a/detections/experimental/endpoint/detect_exchange_web_shell.yml +++ b/detections/experimental/endpoint/detect_exchange_web_shell.yml @@ -6,15 +6,20 @@ author: Michael Haag, Splunk type: batch datamodel: - Endpoint -description: 'The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. - Upon triage, the suspicious .aspx file will have a randomized name of 8 characters long. Review the file for suspect commands. Identify additional log sources, IIS included, to review source and other potential exploitation.' +description: 'The following query identifies suspicious .aspx created in 3 paths identified + by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM + group. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, + and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will have a randomized + name of 8 characters long. Review the file for suspect commands. Identify additional + log sources, IIS included, to review source and other potential exploitation.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" - by _time span=1h Filesystem.process_id Filesystem.file_name - Filesystem.file_path Filesystem.file_hash Filesystem.user | `drop_dm_object_name(Filesystem)` - | rename process_id as aspx_pid | join aspx_pid, _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes where Processes.process_name=w3wp.exe by _time - span=1h Processes.parent_process_id Processes.process_id Processes.process_name + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", + "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" + by _time span=1h Filesystem.process_id Filesystem.file_name Filesystem.file_path + Filesystem.file_hash Filesystem.user | `drop_dm_object_name(Filesystem)` | rename + process_id as aspx_pid | join aspx_pid, _time [| tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Processes where Processes.process_name=w3wp.exe by + _time span=1h Processes.parent_process_id Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process | `drop_dm_object_name(Processes)` | rename parent_process_id as aspx_pid | fields _time aspx_pid process_id dest process_name process_path process] | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -22,8 +27,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime process_name, process, process_path, file_hash | `detect_exchange_web_shell_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. -known_false_positives: The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product. + your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` + node. +known_false_positives: The query is structured in a way that `action` (read, create) + is not defined. Review the results of this query, filter, and tune as necessary. + It may be necessary to generate this query specific to your endpoint product. references: - https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv tags: @@ -38,11 +46,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - security_domain: endpoint required_fields: - _time - Filesystem.file_path - Filesystem.process_id - Filesystem.file_name - Filesystem.file_hash - - Filesystem.user \ No newline at end of file + - Filesystem.user + security_domain: endpoint diff --git a/detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml b/detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml index c2e7d3d4f0..546b1ca211 100644 --- a/detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml +++ b/detections/experimental/endpoint/detect_oulook_exe_writing_a__zip_file.yml @@ -56,5 +56,5 @@ tags: - Processes.process_id - Processes.dest - Processes.parent_process_name - - Processes.user + - Processes.user security_domain: network diff --git a/docs/mitre-map/coverage.csv b/docs/mitre-map/coverage.csv index ae3245171e..a11b970ceb 100644 --- a/docs/mitre-map/coverage.csv +++ b/docs/mitre-map/coverage.csv @@ -17,7 +17,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -40,7 +40,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -91,7 +91,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -106,7 +106,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -121,7 +121,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -152,7 +152,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -186,12 +186,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -203,9 +199,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -237,7 +232,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -286,14 +281,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -315,7 +307,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -341,17 +333,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -367,13 +356,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -436,7 +425,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -456,7 +445,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -467,7 +456,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -514,7 +503,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -534,7 +523,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -577,7 +566,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -586,7 +575,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -604,27 +593,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -683,9 +675,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -697,7 +687,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -729,8 +719,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -765,11 +754,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -779,10 +765,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -795,17 +778,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -825,8 +808,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -852,23 +834,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -934,7 +914,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -957,7 +937,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -1008,7 +988,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -1023,7 +1003,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -1038,7 +1018,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -1069,7 +1049,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -1103,12 +1083,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -1120,9 +1096,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -1154,7 +1129,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -1203,14 +1178,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -1232,7 +1204,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -1258,17 +1230,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -1284,13 +1253,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -1353,7 +1322,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -1373,7 +1342,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -1384,7 +1353,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -1431,7 +1400,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -1451,7 +1420,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -1494,7 +1463,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -1503,7 +1472,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -1521,27 +1490,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -1600,9 +1572,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -1614,7 +1584,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -1646,8 +1616,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -1682,11 +1651,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -1696,10 +1662,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -1712,17 +1675,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -1742,8 +1705,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -1769,23 +1731,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -1851,7 +1811,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -1874,7 +1834,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -1925,7 +1885,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -1940,7 +1900,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -1955,7 +1915,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -1986,7 +1946,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -2020,12 +1980,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -2037,9 +1993,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -2071,7 +2026,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -2120,14 +2075,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -2149,7 +2101,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -2175,17 +2127,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -2201,13 +2150,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -2270,7 +2219,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -2290,7 +2239,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -2301,7 +2250,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -2348,7 +2297,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -2368,7 +2317,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -2411,7 +2360,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -2420,7 +2369,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -2438,27 +2387,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -2517,9 +2469,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -2531,7 +2481,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -2563,8 +2513,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -2599,11 +2548,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -2613,10 +2559,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -2629,17 +2572,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -2659,8 +2602,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -2686,23 +2628,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -2768,7 +2708,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -2791,7 +2731,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -2842,7 +2782,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -2857,7 +2797,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -2872,7 +2812,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -2903,7 +2843,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -2937,12 +2877,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -2954,9 +2890,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -2988,7 +2923,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -3037,14 +2972,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -3066,7 +2998,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -3092,17 +3024,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -3118,13 +3047,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -3187,7 +3116,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -3207,7 +3136,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -3218,7 +3147,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -3265,7 +3194,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -3285,7 +3214,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -3328,7 +3257,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -3337,7 +3266,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -3355,27 +3284,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -3434,9 +3366,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -3448,7 +3378,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -3480,8 +3410,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -3516,11 +3445,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -3530,10 +3456,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -3546,17 +3469,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -3576,8 +3499,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -3603,23 +3525,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -3685,7 +3605,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -3708,7 +3628,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -3759,7 +3679,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -3774,7 +3694,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -3789,7 +3709,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -3820,7 +3740,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -3854,12 +3774,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -3871,9 +3787,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -3905,7 +3820,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -3954,14 +3869,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -3983,7 +3895,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -4009,17 +3921,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -4035,13 +3944,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -4104,7 +4013,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -4124,7 +4033,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -4135,7 +4044,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -4182,7 +4091,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -4202,7 +4111,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -4245,7 +4154,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -4254,7 +4163,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -4272,27 +4181,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -4351,9 +4263,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -4365,7 +4275,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -4397,8 +4307,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -4433,11 +4342,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -4447,10 +4353,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -4463,17 +4366,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -4493,8 +4396,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -4520,23 +4422,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -4602,7 +4502,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -4625,7 +4525,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -4676,7 +4576,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -4691,7 +4591,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -4706,7 +4606,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -4737,7 +4637,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -4771,12 +4671,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -4788,9 +4684,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -4822,7 +4717,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -4871,14 +4766,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -4900,7 +4792,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -4926,17 +4818,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -4952,13 +4841,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -5021,7 +4910,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -5041,7 +4930,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -5052,7 +4941,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -5099,7 +4988,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -5119,7 +5008,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -5162,7 +5051,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -5171,7 +5060,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -5189,27 +5078,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -5268,9 +5160,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -5282,7 +5172,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -5314,8 +5204,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -5350,11 +5239,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -5364,10 +5250,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -5380,17 +5263,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -5410,8 +5293,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -5437,23 +5319,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -5519,7 +5399,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -5542,7 +5422,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -5593,7 +5473,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -5608,7 +5488,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -5623,7 +5503,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -5654,7 +5534,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -5688,12 +5568,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -5705,9 +5581,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -5739,7 +5614,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -5788,14 +5663,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -5817,7 +5689,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -5843,17 +5715,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -5869,13 +5738,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -5938,7 +5807,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -5958,7 +5827,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -5969,7 +5838,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -6016,7 +5885,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -6036,7 +5905,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -6079,7 +5948,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -6088,7 +5957,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -6106,27 +5975,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -6185,9 +6057,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -6199,7 +6069,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -6231,8 +6101,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -6267,11 +6136,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -6281,10 +6147,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -6297,17 +6160,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -6327,8 +6190,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -6354,23 +6216,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -6436,7 +6296,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -6459,7 +6319,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -6510,7 +6370,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -6525,7 +6385,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -6540,7 +6400,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -6571,7 +6431,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -6605,12 +6465,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -6622,9 +6478,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -6656,7 +6511,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -6705,14 +6560,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -6734,7 +6586,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -6760,17 +6612,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -6786,13 +6635,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -6855,7 +6704,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -6875,7 +6724,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -6886,7 +6735,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -6933,7 +6782,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -6953,7 +6802,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -6996,7 +6845,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -7005,7 +6854,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -7023,27 +6872,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -7102,9 +6954,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -7116,7 +6966,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -7148,8 +6998,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -7184,11 +7033,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -7198,10 +7044,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -7214,17 +7057,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -7244,8 +7087,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -7271,23 +7113,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -7353,7 +7193,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -7376,7 +7216,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -7427,7 +7267,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -7442,7 +7282,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -7457,7 +7297,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -7488,7 +7328,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -7522,12 +7362,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -7539,9 +7375,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -7573,7 +7408,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -7622,14 +7457,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -7651,7 +7483,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -7677,17 +7509,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -7703,13 +7532,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -7772,7 +7601,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -7792,7 +7621,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -7803,7 +7632,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -7850,7 +7679,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -7870,7 +7699,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -7913,7 +7742,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -7922,7 +7751,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -7940,27 +7769,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -8019,9 +7851,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -8033,7 +7863,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -8065,8 +7895,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -8101,11 +7930,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -8115,10 +7941,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -8131,17 +7954,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -8161,8 +7984,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -8188,23 +8010,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -8270,7 +8090,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -8293,7 +8113,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -8344,7 +8164,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -8359,7 +8179,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -8374,7 +8194,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -8405,7 +8225,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -8439,12 +8259,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -8456,9 +8272,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -8490,7 +8305,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -8539,14 +8354,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -8568,7 +8380,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -8594,17 +8406,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -8620,13 +8429,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -8689,7 +8498,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -8709,7 +8518,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -8720,7 +8529,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -8767,7 +8576,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -8787,7 +8596,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -8830,7 +8639,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -8839,7 +8648,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -8857,27 +8666,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -8936,9 +8748,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -8950,7 +8760,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -8982,8 +8792,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -9018,11 +8827,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -9032,10 +8838,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -9048,17 +8851,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -9078,8 +8881,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -9105,23 +8907,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -9187,7 +8987,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -9210,7 +9010,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -9261,7 +9061,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -9276,7 +9076,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -9291,7 +9091,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -9322,7 +9122,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -9356,12 +9156,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -9373,9 +9169,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -9407,7 +9202,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -9456,14 +9251,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -9485,7 +9277,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -9511,17 +9303,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -9537,13 +9326,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -9606,7 +9395,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -9626,7 +9415,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -9637,7 +9426,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -9684,7 +9473,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -9704,7 +9493,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -9747,7 +9536,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -9756,7 +9545,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -9774,27 +9563,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -9853,9 +9645,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -9867,7 +9657,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -9899,8 +9689,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -9935,11 +9724,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -9949,10 +9735,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -9965,17 +9748,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -9995,8 +9778,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -10022,23 +9804,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -10104,7 +9884,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -10127,7 +9907,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -10178,7 +9958,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -10193,7 +9973,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -10208,7 +9988,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -10239,7 +10019,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -10273,12 +10053,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -10290,9 +10066,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -10324,7 +10099,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -10373,14 +10148,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -10402,7 +10174,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -10428,17 +10200,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -10454,13 +10223,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -10523,7 +10292,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -10543,7 +10312,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -10554,7 +10323,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -10601,7 +10370,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -10621,7 +10390,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -10664,7 +10433,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -10673,7 +10442,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -10691,27 +10460,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -10770,9 +10542,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -10784,7 +10554,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -10816,8 +10586,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -10852,11 +10621,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -10866,10 +10632,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -10882,17 +10645,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -10912,8 +10675,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -10939,23 +10701,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -11021,7 +10781,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -11044,7 +10804,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -11095,7 +10855,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -11110,7 +10870,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -11125,7 +10885,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -11156,7 +10916,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -11190,12 +10950,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -11207,9 +10963,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -11241,7 +10996,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -11290,14 +11045,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -11319,7 +11071,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -11345,17 +11097,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -11371,13 +11120,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -11440,7 +11189,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -11460,7 +11209,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -11471,7 +11220,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -11518,7 +11267,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -11538,7 +11287,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -11581,7 +11330,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -11590,7 +11339,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -11608,27 +11357,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -11687,9 +11439,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -11701,7 +11451,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -11733,8 +11483,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -11769,11 +11518,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -11783,10 +11529,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -11799,17 +11542,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -11829,8 +11572,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -11856,23 +11598,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -11938,7 +11678,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -11961,7 +11701,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -12012,7 +11752,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -12027,7 +11767,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -12042,7 +11782,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -12073,7 +11813,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -12107,12 +11847,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -12124,9 +11860,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -12158,7 +11893,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -12207,14 +11942,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -12236,7 +11968,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -12262,17 +11994,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -12288,13 +12017,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -12357,7 +12086,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -12377,7 +12106,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -12388,7 +12117,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -12435,7 +12164,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -12455,7 +12184,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -12498,7 +12227,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -12507,7 +12236,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -12525,27 +12254,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -12604,9 +12336,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -12618,7 +12348,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -12650,8 +12380,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -12686,11 +12415,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -12700,10 +12426,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -12716,17 +12439,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -12746,8 +12469,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -12773,23 +12495,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -12855,7 +12575,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -12878,7 +12598,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -12929,7 +12649,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -12944,7 +12664,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -12959,7 +12679,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -12990,7 +12710,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -13024,12 +12744,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -13041,9 +12757,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -13075,7 +12790,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -13124,14 +12839,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -13153,7 +12865,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -13179,17 +12891,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -13205,13 +12914,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -13274,7 +12983,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -13294,7 +13003,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -13305,7 +13014,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -13352,7 +13061,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -13372,7 +13081,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -13415,7 +13124,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -13424,7 +13133,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -13442,27 +13151,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -13521,9 +13233,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -13535,7 +13245,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -13567,8 +13277,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -13603,11 +13312,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -13617,10 +13323,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -13633,17 +13336,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -13663,8 +13366,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -13690,23 +13392,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -13772,7 +13472,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -13795,7 +13495,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -13846,7 +13546,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -13861,7 +13561,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -13876,7 +13576,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -13907,7 +13607,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -13941,12 +13641,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -13958,9 +13654,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -13992,7 +13687,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -14041,14 +13736,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -14070,7 +13762,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -14096,17 +13788,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -14122,13 +13811,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -14191,7 +13880,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -14211,7 +13900,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -14222,7 +13911,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -14269,7 +13958,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -14289,7 +13978,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -14332,7 +14021,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -14341,7 +14030,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -14359,27 +14048,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -14438,9 +14130,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -14452,7 +14142,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -14484,8 +14174,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -14520,11 +14209,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -14534,10 +14220,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -14550,17 +14233,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -14580,8 +14263,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -14607,23 +14289,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -14689,7 +14369,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -14712,7 +14392,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -14763,7 +14443,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -14778,7 +14458,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -14793,7 +14473,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -14824,7 +14504,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -14858,12 +14538,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -14875,9 +14551,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -14909,7 +14584,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -14958,14 +14633,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -14987,7 +14659,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -15013,17 +14685,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -15039,13 +14708,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -15108,7 +14777,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -15128,7 +14797,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -15139,7 +14808,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -15186,7 +14855,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -15206,7 +14875,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -15249,7 +14918,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -15258,7 +14927,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -15276,27 +14945,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -15355,9 +15027,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -15369,7 +15039,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -15401,8 +15071,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -15437,11 +15106,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -15451,10 +15117,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -15467,17 +15130,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -15497,8 +15160,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -15524,23 +15186,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -15606,7 +15266,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -15629,7 +15289,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -15680,7 +15340,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -15695,7 +15355,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -15710,7 +15370,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -15741,7 +15401,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -15775,12 +15435,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -15792,9 +15448,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -15826,7 +15481,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -15875,14 +15530,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -15904,7 +15556,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -15930,17 +15582,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -15956,13 +15605,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -16025,7 +15674,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -16045,7 +15694,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -16056,7 +15705,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -16103,7 +15752,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -16123,7 +15772,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -16166,7 +15815,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -16175,7 +15824,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -16193,27 +15842,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -16272,9 +15924,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -16286,7 +15936,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -16318,8 +15968,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -16354,11 +16003,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -16368,10 +16014,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -16384,17 +16027,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -16414,8 +16057,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -16441,23 +16083,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -16523,7 +16163,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -16546,7 +16186,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -16597,7 +16237,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -16612,7 +16252,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -16627,7 +16267,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -16658,7 +16298,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -16692,12 +16332,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -16709,9 +16345,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -16743,7 +16378,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -16792,14 +16427,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -16821,7 +16453,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -16847,17 +16479,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -16873,13 +16502,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -16942,7 +16571,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -16962,7 +16591,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -16973,7 +16602,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -17020,7 +16649,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -17040,7 +16669,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -17083,7 +16712,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -17092,7 +16721,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -17110,27 +16739,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -17189,9 +16821,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -17203,7 +16833,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -17235,8 +16865,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -17271,11 +16900,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -17285,10 +16911,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -17301,17 +16924,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -17331,8 +16954,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -17358,23 +16980,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -17440,7 +17060,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -17463,7 +17083,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -17514,7 +17134,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -17529,7 +17149,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -17544,7 +17164,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -17575,7 +17195,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -17609,12 +17229,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -17626,9 +17242,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -17660,7 +17275,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -17709,14 +17324,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -17738,7 +17350,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -17764,17 +17376,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -17790,13 +17399,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -17859,7 +17468,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -17879,7 +17488,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -17890,7 +17499,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -17937,7 +17546,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -17957,7 +17566,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -18000,7 +17609,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -18009,7 +17618,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -18027,27 +17636,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -18106,9 +17718,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -18120,7 +17730,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -18152,8 +17762,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -18188,11 +17797,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -18202,10 +17808,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -18218,17 +17821,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -18248,8 +17851,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -18275,23 +17877,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -18357,7 +17957,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -18380,7 +17980,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -18431,7 +18031,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -18446,7 +18046,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -18461,7 +18061,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -18492,7 +18092,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -18526,12 +18126,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -18543,9 +18139,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -18577,7 +18172,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -18626,14 +18221,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -18655,7 +18247,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -18681,17 +18273,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -18707,13 +18296,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -18776,7 +18365,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -18796,7 +18385,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -18807,7 +18396,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -18854,7 +18443,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -18874,7 +18463,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -18917,7 +18506,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -18926,7 +18515,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -18944,27 +18533,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -19023,9 +18615,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -19037,7 +18627,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -19069,8 +18659,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -19105,11 +18694,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -19119,10 +18705,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -19135,17 +18718,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -19165,8 +18748,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -19192,23 +18774,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -19274,7 +18854,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -19297,7 +18877,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -19348,7 +18928,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -19363,7 +18943,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -19378,7 +18958,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -19409,7 +18989,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -19443,12 +19023,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -19460,9 +19036,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -19494,7 +19069,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -19543,14 +19118,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -19572,7 +19144,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -19598,17 +19170,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -19624,13 +19193,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -19693,7 +19262,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -19713,7 +19282,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -19724,7 +19293,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -19771,7 +19340,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -19791,7 +19360,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -19834,7 +19403,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -19843,7 +19412,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -19861,27 +19430,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -19940,9 +19512,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -19954,7 +19524,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -19986,8 +19556,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -20022,11 +19591,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -20036,10 +19602,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -20052,17 +19615,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -20082,8 +19645,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -20109,23 +19671,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -20191,7 +19751,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -20214,7 +19774,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -20265,7 +19825,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -20280,7 +19840,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -20295,7 +19855,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -20326,7 +19886,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -20360,12 +19920,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -20377,9 +19933,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -20411,7 +19966,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -20460,14 +20015,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -20489,7 +20041,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -20515,17 +20067,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -20541,13 +20090,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -20610,7 +20159,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -20630,7 +20179,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -20641,7 +20190,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -20688,7 +20237,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -20708,7 +20257,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -20751,7 +20300,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -20760,7 +20309,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -20778,27 +20327,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -20857,9 +20409,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -20871,7 +20421,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -20903,8 +20453,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -20939,11 +20488,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -20953,10 +20499,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -20969,17 +20512,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -20999,8 +20542,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -21026,23 +20568,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -21108,7 +20648,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -21131,7 +20671,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -21182,7 +20722,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -21197,7 +20737,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -21212,7 +20752,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -21243,7 +20783,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -21277,12 +20817,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -21294,9 +20830,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -21328,7 +20863,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -21377,14 +20912,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -21406,7 +20938,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -21432,17 +20964,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -21458,13 +20987,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -21527,7 +21056,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -21547,7 +21076,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -21558,7 +21087,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -21605,7 +21134,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -21625,7 +21154,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -21668,7 +21197,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -21677,7 +21206,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -21695,27 +21224,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -21774,9 +21306,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -21788,7 +21318,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -21820,8 +21350,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -21856,11 +21385,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -21870,10 +21396,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -21886,17 +21409,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -21916,8 +21439,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -21943,23 +21465,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -22025,7 +21545,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -22048,7 +21568,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -22099,7 +21619,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -22114,7 +21634,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -22129,7 +21649,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -22160,7 +21680,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -22194,12 +21714,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -22211,9 +21727,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -22245,7 +21760,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -22294,14 +21809,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -22323,7 +21835,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -22349,17 +21861,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -22375,13 +21884,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -22444,7 +21953,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -22464,7 +21973,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -22475,7 +21984,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -22522,7 +22031,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -22542,7 +22051,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -22585,7 +22094,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -22594,7 +22103,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -22612,27 +22121,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -22691,9 +22203,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -22705,7 +22215,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -22737,8 +22247,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -22773,11 +22282,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -22787,10 +22293,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -22803,17 +22306,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -22833,8 +22336,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -22860,23 +22362,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -22942,7 +22442,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -22965,7 +22465,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -23016,7 +22516,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -23031,7 +22531,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -23046,7 +22546,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -23077,7 +22577,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -23111,12 +22611,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -23128,9 +22624,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -23162,7 +22657,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -23211,14 +22706,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -23240,7 +22732,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -23266,17 +22758,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -23292,13 +22781,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -23361,7 +22850,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -23381,7 +22870,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -23392,7 +22881,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -23439,7 +22928,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -23459,7 +22948,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -23502,7 +22991,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -23511,7 +23000,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -23529,27 +23018,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -23608,9 +23100,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -23622,7 +23112,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -23654,8 +23144,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -23690,11 +23179,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -23704,10 +23190,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -23720,17 +23203,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -23750,8 +23233,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -23777,23 +23259,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -23859,7 +23339,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -23882,7 +23362,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -23933,7 +23413,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -23948,7 +23428,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -23963,7 +23443,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -23994,7 +23474,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -24028,12 +23508,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -24045,9 +23521,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -24079,7 +23554,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -24128,14 +23603,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -24157,7 +23629,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -24183,17 +23655,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -24209,13 +23678,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -24278,7 +23747,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -24298,7 +23767,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -24309,7 +23778,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -24356,7 +23825,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -24376,7 +23845,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -24419,7 +23888,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -24428,7 +23897,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -24446,27 +23915,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -24525,9 +23997,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -24539,7 +24009,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -24571,8 +24041,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -24607,11 +24076,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -24621,10 +24087,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -24637,17 +24100,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -24667,8 +24130,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -24694,23 +24156,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -24776,7 +24236,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -24799,7 +24259,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -24850,7 +24310,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -24865,7 +24325,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -24880,7 +24340,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -24911,7 +24371,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -24945,12 +24405,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -24962,9 +24418,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -24996,7 +24451,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -25045,14 +24500,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -25074,7 +24526,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -25100,17 +24552,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -25126,13 +24575,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -25195,7 +24644,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -25215,7 +24664,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -25226,7 +24675,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -25273,7 +24722,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -25293,7 +24742,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -25336,7 +24785,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -25345,7 +24794,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -25363,27 +24812,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -25442,9 +24894,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -25456,7 +24906,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -25488,8 +24938,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -25524,11 +24973,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -25538,10 +24984,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -25554,17 +24997,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -25584,8 +25027,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -25611,23 +25053,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -25693,7 +25133,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -25716,7 +25156,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -25767,7 +25207,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -25782,7 +25222,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -25797,7 +25237,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -25828,7 +25268,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -25862,12 +25302,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -25879,9 +25315,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -25913,7 +25348,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -25962,14 +25397,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -25991,7 +25423,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -26017,17 +25449,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -26043,13 +25472,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -26112,7 +25541,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -26132,7 +25561,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -26143,7 +25572,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -26190,7 +25619,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -26210,7 +25639,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -26253,7 +25682,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -26262,7 +25691,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -26280,27 +25709,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -26359,9 +25791,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -26373,7 +25803,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -26405,8 +25835,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -26441,11 +25870,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -26455,10 +25881,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -26471,17 +25894,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -26501,8 +25924,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -26528,23 +25950,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -26610,7 +26030,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -26633,7 +26053,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -26684,7 +26104,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -26699,7 +26119,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -26714,7 +26134,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -26745,7 +26165,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -26779,12 +26199,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -26796,9 +26212,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -26830,7 +26245,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -26879,14 +26294,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -26908,7 +26320,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -26934,17 +26346,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -26960,13 +26369,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -27029,7 +26438,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -27049,7 +26458,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -27060,7 +26469,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -27107,7 +26516,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -27127,7 +26536,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -27170,7 +26579,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -27179,7 +26588,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -27197,27 +26606,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -27276,9 +26688,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -27290,7 +26700,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -27322,8 +26732,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -27358,11 +26767,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -27372,10 +26778,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -27388,17 +26791,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -27418,8 +26821,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -27445,23 +26847,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -27527,7 +26927,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -27550,7 +26950,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -27601,7 +27001,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -27616,7 +27016,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -27631,7 +27031,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -27662,7 +27062,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -27696,12 +27096,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -27713,9 +27109,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -27747,7 +27142,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -27796,14 +27191,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -27825,7 +27217,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -27851,17 +27243,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -27877,13 +27266,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -27946,7 +27335,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -27966,7 +27355,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -27977,7 +27366,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -28024,7 +27413,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -28044,7 +27433,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -28087,7 +27476,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -28096,7 +27485,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -28114,27 +27503,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -28193,9 +27585,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -28207,7 +27597,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -28239,8 +27629,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -28275,11 +27664,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -28289,10 +27675,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -28305,17 +27688,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -28335,8 +27718,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -28362,23 +27744,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -28444,7 +27824,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -28467,7 +27847,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -28518,7 +27898,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -28533,7 +27913,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -28548,7 +27928,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -28579,7 +27959,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -28613,12 +27993,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -28630,9 +28006,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -28664,7 +28039,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -28713,14 +28088,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -28742,7 +28114,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -28768,17 +28140,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -28794,13 +28163,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -28863,7 +28232,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -28883,7 +28252,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -28894,7 +28263,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -28941,7 +28310,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -28961,7 +28330,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -29004,7 +28373,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -29013,7 +28382,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -29031,27 +28400,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -29110,9 +28482,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -29124,7 +28494,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -29156,8 +28526,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -29192,11 +28561,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -29206,10 +28572,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -29222,17 +28585,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -29252,8 +28615,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -29279,23 +28641,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -29361,7 +28721,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -29384,7 +28744,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -29435,7 +28795,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -29450,7 +28810,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -29465,7 +28825,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -29496,7 +28856,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -29530,12 +28890,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -29547,9 +28903,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -29581,7 +28936,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -29630,14 +28985,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -29659,7 +29011,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -29685,17 +29037,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -29711,13 +29060,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -29780,7 +29129,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -29800,7 +29149,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -29811,7 +29160,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -29858,7 +29207,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -29878,7 +29227,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -29921,7 +29270,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -29930,7 +29279,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -29948,27 +29297,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -30027,9 +29379,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -30041,7 +29391,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -30073,8 +29423,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -30109,11 +29458,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -30123,10 +29469,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -30139,17 +29482,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -30169,8 +29512,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -30196,23 +29538,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -30278,7 +29618,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -30301,7 +29641,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -30352,7 +29692,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -30367,7 +29707,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -30382,7 +29722,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -30413,7 +29753,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -30447,12 +29787,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -30464,9 +29800,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -30498,7 +29833,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -30547,14 +29882,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -30576,7 +29908,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -30602,17 +29934,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -30628,13 +29957,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -30697,7 +30026,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -30717,7 +30046,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -30728,7 +30057,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -30775,7 +30104,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -30795,7 +30124,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -30838,7 +30167,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -30847,7 +30176,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -30865,27 +30194,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -30944,9 +30276,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -30958,7 +30288,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -30990,8 +30320,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -31026,11 +30355,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -31040,10 +30366,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -31056,17 +30379,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -31086,8 +30409,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -31113,23 +30435,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -31195,7 +30515,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -31218,7 +30538,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -31269,7 +30589,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -31284,7 +30604,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -31299,7 +30619,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -31330,7 +30650,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -31364,12 +30684,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -31381,9 +30697,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -31415,7 +30730,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -31464,14 +30779,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -31493,7 +30805,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -31519,17 +30831,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -31545,13 +30854,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -31614,7 +30923,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -31634,7 +30943,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -31645,7 +30954,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -31692,7 +31001,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -31712,7 +31021,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -31755,7 +31064,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -31764,7 +31073,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -31782,27 +31091,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -31861,9 +31173,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -31875,7 +31185,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -31907,8 +31217,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -31943,11 +31252,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -31957,10 +31263,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -31973,17 +31276,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -32003,8 +31306,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -32030,23 +31332,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -32112,7 +31412,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -32135,7 +31435,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -32186,7 +31486,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -32201,7 +31501,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -32216,7 +31516,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -32247,7 +31547,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -32281,12 +31581,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -32298,9 +31594,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -32332,7 +31627,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -32381,14 +31676,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -32410,7 +31702,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -32436,17 +31728,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -32462,13 +31751,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -32531,7 +31820,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -32551,7 +31840,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -32562,7 +31851,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -32609,7 +31898,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -32629,7 +31918,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -32672,7 +31961,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -32681,7 +31970,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -32699,27 +31988,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -32778,9 +32070,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -32792,7 +32082,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -32824,8 +32114,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -32860,11 +32149,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -32874,10 +32160,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -32890,17 +32173,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -32920,8 +32203,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -32947,23 +32229,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -33029,7 +32309,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -33052,7 +32332,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -33103,7 +32383,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -33118,7 +32398,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -33133,7 +32413,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -33164,7 +32444,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -33198,12 +32478,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -33215,9 +32491,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -33249,7 +32524,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -33298,14 +32573,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -33327,7 +32599,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -33353,17 +32625,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -33379,13 +32648,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -33448,7 +32717,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -33468,7 +32737,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -33479,7 +32748,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -33526,7 +32795,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -33546,7 +32815,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -33589,7 +32858,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -33598,7 +32867,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -33616,27 +32885,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -33695,9 +32967,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -33709,7 +32979,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -33741,8 +33011,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -33777,11 +33046,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -33791,10 +33057,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -33807,17 +33070,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -33837,8 +33100,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -33864,23 +33126,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -33946,7 +33206,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -33969,7 +33229,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -34020,7 +33280,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -34035,7 +33295,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -34050,7 +33310,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -34081,7 +33341,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -34115,12 +33375,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -34132,9 +33388,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -34166,7 +33421,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -34215,14 +33470,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -34244,7 +33496,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -34270,17 +33522,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -34296,13 +33545,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -34365,7 +33614,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -34385,7 +33634,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -34396,7 +33645,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -34443,7 +33692,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -34463,7 +33712,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -34506,7 +33755,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -34515,7 +33764,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -34533,27 +33782,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -34612,9 +33864,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -34626,7 +33876,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -34658,8 +33908,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -34694,11 +33943,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -34708,10 +33954,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -34724,17 +33967,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -34754,8 +33997,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -34781,23 +34023,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -34863,7 +34103,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -34886,7 +34126,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -34937,7 +34177,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -34952,7 +34192,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -34967,7 +34207,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -34998,7 +34238,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -35032,12 +34272,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -35049,9 +34285,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -35083,7 +34318,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -35132,14 +34367,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -35161,7 +34393,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -35187,17 +34419,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -35213,13 +34442,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -35282,7 +34511,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -35302,7 +34531,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -35313,7 +34542,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -35360,7 +34589,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -35380,7 +34609,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -35423,7 +34652,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -35432,7 +34661,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -35450,27 +34679,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -35529,9 +34761,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -35543,7 +34773,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -35575,8 +34805,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -35611,11 +34840,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -35625,10 +34851,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -35641,17 +34864,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -35671,8 +34894,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -35698,23 +34920,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -35780,7 +35000,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -35803,7 +35023,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -35854,7 +35074,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -35869,7 +35089,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -35884,7 +35104,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -35915,7 +35135,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -35949,12 +35169,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -35966,9 +35182,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -36000,7 +35215,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -36049,14 +35264,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -36078,7 +35290,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -36104,17 +35316,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -36130,13 +35339,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -36199,7 +35408,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -36219,7 +35428,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -36230,7 +35439,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -36277,7 +35486,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -36297,7 +35506,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -36340,7 +35549,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -36349,7 +35558,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -36367,27 +35576,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -36446,9 +35658,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -36460,7 +35670,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -36492,8 +35702,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -36528,11 +35737,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -36542,10 +35748,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -36558,17 +35761,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -36588,8 +35791,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -36615,23 +35817,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -36697,7 +35897,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -36720,7 +35920,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -36771,7 +35971,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -36786,7 +35986,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -36801,7 +36001,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -36832,7 +36032,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -36866,12 +36066,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -36883,9 +36079,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -36917,7 +36112,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -36966,14 +36161,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -36995,7 +36187,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -37021,17 +36213,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -37047,13 +36236,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -37116,7 +36305,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -37136,7 +36325,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -37147,7 +36336,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -37194,7 +36383,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -37214,7 +36403,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -37257,7 +36446,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -37266,7 +36455,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -37284,27 +36473,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -37363,9 +36555,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -37377,7 +36567,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -37409,8 +36599,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -37445,11 +36634,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -37459,10 +36645,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -37475,17 +36658,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -37505,8 +36688,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -37532,23 +36714,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -37614,7 +36794,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -37637,7 +36817,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -37688,7 +36868,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -37703,7 +36883,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -37718,7 +36898,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -37749,7 +36929,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -37783,12 +36963,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -37800,9 +36976,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -37834,7 +37009,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -37883,14 +37058,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -37912,7 +37084,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -37938,17 +37110,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -37964,13 +37133,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -38033,7 +37202,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -38053,7 +37222,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -38064,7 +37233,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -38111,7 +37280,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -38131,7 +37300,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -38174,7 +37343,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -38183,7 +37352,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -38201,27 +37370,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -38280,9 +37452,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -38294,7 +37464,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -38326,8 +37496,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -38362,11 +37531,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -38376,10 +37542,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -38392,17 +37555,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -38422,8 +37585,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -38449,23 +37611,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -38531,7 +37691,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -38554,7 +37714,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -38605,7 +37765,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -38620,7 +37780,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -38635,7 +37795,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -38666,7 +37826,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -38700,12 +37860,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -38717,9 +37873,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -38751,7 +37906,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -38800,14 +37955,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -38829,7 +37981,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -38855,17 +38007,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -38881,13 +38030,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -38950,7 +38099,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -38970,7 +38119,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -38981,7 +38130,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -39028,7 +38177,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -39048,7 +38197,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -39091,7 +38240,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -39100,7 +38249,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -39118,27 +38267,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -39197,9 +38349,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -39211,7 +38361,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -39243,8 +38393,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -39279,11 +38428,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -39293,10 +38439,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -39309,17 +38452,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -39339,8 +38482,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -39366,23 +38508,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -39448,7 +38588,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -39471,7 +38611,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -39522,7 +38662,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -39537,7 +38677,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -39552,7 +38692,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -39583,7 +38723,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -39617,12 +38757,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -39634,9 +38770,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -39668,7 +38803,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -39717,14 +38852,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -39746,7 +38878,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -39772,17 +38904,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -39798,13 +38927,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -39867,7 +38996,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -39887,7 +39016,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -39898,7 +39027,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -39945,7 +39074,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -39965,7 +39094,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -40008,7 +39137,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -40017,7 +39146,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -40035,27 +39164,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -40114,9 +39246,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -40128,7 +39258,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -40160,8 +39290,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -40196,11 +39325,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -40210,10 +39336,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -40226,17 +39349,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -40256,8 +39379,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -40283,23 +39405,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -40365,7 +39485,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -40388,7 +39508,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -40439,7 +39559,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -40454,7 +39574,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -40469,7 +39589,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -40500,7 +39620,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -40534,12 +39654,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -40551,9 +39667,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -40585,7 +39700,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -40634,14 +39749,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -40663,7 +39775,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -40689,17 +39801,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -40715,13 +39824,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -40784,7 +39893,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -40804,7 +39913,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -40815,7 +39924,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -40862,7 +39971,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -40882,7 +39991,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -40925,7 +40034,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -40934,7 +40043,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -40952,27 +40061,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -41031,9 +40143,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -41045,7 +40155,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -41077,8 +40187,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -41113,11 +40222,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -41127,10 +40233,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -41143,17 +40246,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -41173,8 +40276,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -41200,23 +40302,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -41282,7 +40382,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -41305,7 +40405,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -41356,7 +40456,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -41371,7 +40471,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -41386,7 +40486,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -41417,7 +40517,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -41451,12 +40551,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -41468,9 +40564,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -41502,7 +40597,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -41551,14 +40646,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -41580,7 +40672,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -41606,17 +40698,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -41632,13 +40721,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -41701,7 +40790,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -41721,7 +40810,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -41732,7 +40821,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -41779,7 +40868,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -41799,7 +40888,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -41842,7 +40931,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -41851,7 +40940,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -41869,27 +40958,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -41948,9 +41040,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -41962,7 +41052,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -41994,8 +41084,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -42030,11 +41119,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -42044,10 +41130,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -42060,17 +41143,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -42090,8 +41173,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -42117,23 +41199,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -42199,7 +41279,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -42222,7 +41302,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -42273,7 +41353,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -42288,7 +41368,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -42303,7 +41383,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -42334,7 +41414,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -42368,12 +41448,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -42385,9 +41461,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -42419,7 +41494,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -42468,14 +41543,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -42497,7 +41569,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -42523,17 +41595,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -42549,13 +41618,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -42618,7 +41687,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -42638,7 +41707,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -42649,7 +41718,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -42696,7 +41765,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -42716,7 +41785,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -42759,7 +41828,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -42768,7 +41837,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -42786,27 +41855,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -42865,9 +41937,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -42879,7 +41949,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -42911,8 +41981,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -42947,11 +42016,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -42961,10 +42027,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -42977,17 +42040,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -43007,8 +42070,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -43034,23 +42096,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -43116,7 +42176,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -43139,7 +42199,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -43190,7 +42250,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -43205,7 +42265,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -43220,7 +42280,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -43251,7 +42311,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -43285,12 +42345,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -43302,9 +42358,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -43336,7 +42391,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -43385,14 +42440,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -43414,7 +42466,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -43440,17 +42492,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -43466,13 +42515,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -43535,7 +42584,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -43555,7 +42604,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -43566,7 +42615,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -43613,7 +42662,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -43633,7 +42682,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -43676,7 +42725,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -43685,7 +42734,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -43703,27 +42752,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -43782,9 +42834,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -43796,7 +42846,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -43828,8 +42878,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -43864,11 +42913,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -43878,10 +42924,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -43894,17 +42937,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -43924,8 +42967,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -43951,23 +42993,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -44033,7 +43073,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -44056,7 +43096,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -44107,7 +43147,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -44122,7 +43162,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -44137,7 +43177,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -44168,7 +43208,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -44202,12 +43242,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -44219,9 +43255,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -44253,7 +43288,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -44302,14 +43337,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -44331,7 +43363,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -44357,17 +43389,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -44383,13 +43412,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -44452,7 +43481,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -44472,7 +43501,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -44483,7 +43512,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -44530,7 +43559,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -44550,7 +43579,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -44593,7 +43622,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -44602,7 +43631,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -44620,27 +43649,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -44699,9 +43731,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -44713,7 +43743,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -44745,8 +43775,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -44781,11 +43810,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -44795,10 +43821,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -44811,17 +43834,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -44841,8 +43864,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -44868,23 +43890,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -44950,7 +43970,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -44973,7 +43993,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -45024,7 +44044,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -45039,7 +44059,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -45054,7 +44074,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -45085,7 +44105,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -45119,12 +44139,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -45136,9 +44152,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -45170,7 +44185,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -45219,14 +44234,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -45248,7 +44260,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -45274,17 +44286,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -45300,13 +44309,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -45369,7 +44378,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -45389,7 +44398,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -45400,7 +44409,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -45447,7 +44456,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -45467,7 +44476,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -45510,7 +44519,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -45519,7 +44528,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -45537,27 +44546,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -45616,9 +44628,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -45630,7 +44640,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -45662,8 +44672,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -45698,11 +44707,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -45712,10 +44718,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -45728,17 +44731,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -45758,8 +44761,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -45785,23 +44787,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -45867,7 +44867,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -45890,7 +44890,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -45941,7 +44941,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -45956,7 +44956,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -45971,7 +44971,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -46002,7 +45002,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -46036,12 +45036,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -46053,9 +45049,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -46087,7 +45082,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -46136,14 +45131,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -46165,7 +45157,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -46191,17 +45183,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -46217,13 +45206,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -46286,7 +45275,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -46306,7 +45295,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -46317,7 +45306,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -46364,7 +45353,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -46384,7 +45373,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -46427,7 +45416,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -46436,7 +45425,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -46454,27 +45443,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -46533,9 +45525,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -46547,7 +45537,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -46579,8 +45569,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -46615,11 +45604,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -46629,10 +45615,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -46645,17 +45628,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -46675,8 +45658,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -46702,23 +45684,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -46784,7 +45764,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -46807,7 +45787,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -46858,7 +45838,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -46873,7 +45853,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -46888,7 +45868,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -46919,7 +45899,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -46953,12 +45933,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -46970,9 +45946,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -47004,7 +45979,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -47053,14 +46028,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -47082,7 +46054,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -47108,17 +46080,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -47134,13 +46103,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -47203,7 +46172,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -47223,7 +46192,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -47234,7 +46203,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -47281,7 +46250,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -47301,7 +46270,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -47344,7 +46313,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -47353,7 +46322,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -47371,27 +46340,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -47450,9 +46422,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -47464,7 +46434,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -47496,8 +46466,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -47532,11 +46501,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -47546,10 +46512,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -47562,17 +46525,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -47592,8 +46555,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -47619,23 +46581,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -47701,7 +46661,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -47724,7 +46684,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -47775,7 +46735,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -47790,7 +46750,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -47805,7 +46765,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -47836,7 +46796,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -47870,12 +46830,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -47887,9 +46843,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -47921,7 +46876,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -47970,14 +46925,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -47999,7 +46951,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -48025,17 +46977,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -48051,13 +47000,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -48120,7 +47069,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -48140,7 +47089,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -48151,7 +47100,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -48198,7 +47147,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -48218,7 +47167,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -48261,7 +47210,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -48270,7 +47219,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -48288,27 +47237,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -48367,9 +47319,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -48381,7 +47331,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -48413,8 +47363,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -48449,11 +47398,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -48463,10 +47409,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -48479,17 +47422,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -48509,8 +47452,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -48536,23 +47478,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -48618,7 +47558,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -48641,7 +47581,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -48692,7 +47632,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -48707,7 +47647,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -48722,7 +47662,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -48753,7 +47693,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -48787,12 +47727,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -48804,9 +47740,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -48838,7 +47773,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -48887,14 +47822,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -48916,7 +47848,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -48942,17 +47874,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -48968,13 +47897,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -49037,7 +47966,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -49057,7 +47986,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -49068,7 +47997,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -49115,7 +48044,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -49135,7 +48064,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -49178,7 +48107,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -49187,7 +48116,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -49205,27 +48134,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -49284,9 +48216,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -49298,7 +48228,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -49330,8 +48260,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -49366,11 +48295,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -49380,10 +48306,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -49396,17 +48319,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -49426,8 +48349,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -49453,23 +48375,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -49535,7 +48455,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -49558,7 +48478,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -49609,7 +48529,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -49624,7 +48544,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -49639,7 +48559,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -49670,7 +48590,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -49704,12 +48624,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -49721,9 +48637,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -49755,7 +48670,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -49804,14 +48719,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -49833,7 +48745,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -49859,17 +48771,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -49885,13 +48794,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -49954,7 +48863,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -49974,7 +48883,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -49985,7 +48894,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -50032,7 +48941,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -50052,7 +48961,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -50095,7 +49004,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -50104,7 +49013,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -50122,27 +49031,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -50201,9 +49113,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -50215,7 +49125,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -50247,8 +49157,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -50283,11 +49192,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -50297,10 +49203,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -50313,17 +49216,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -50343,8 +49246,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -50370,23 +49272,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -50452,7 +49352,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -50475,7 +49375,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -50526,7 +49426,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -50541,7 +49441,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -50556,7 +49456,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -50587,7 +49487,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -50621,12 +49521,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -50638,9 +49534,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -50672,7 +49567,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -50721,14 +49616,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -50750,7 +49642,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -50776,17 +49668,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -50802,13 +49691,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -50871,7 +49760,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -50891,7 +49780,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -50902,7 +49791,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -50949,7 +49838,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -50969,7 +49858,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -51012,7 +49901,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -51021,7 +49910,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -51039,27 +49928,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -51118,9 +50010,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -51132,7 +50022,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -51164,8 +50054,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -51200,11 +50089,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -51214,10 +50100,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -51230,17 +50113,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -51260,8 +50143,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -51287,23 +50169,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -51369,7 +50249,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -51392,7 +50272,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -51443,7 +50323,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -51458,7 +50338,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -51473,7 +50353,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -51504,7 +50384,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -51538,12 +50418,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -51555,9 +50431,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -51589,7 +50464,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -51638,14 +50513,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -51667,7 +50539,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -51693,17 +50565,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -51719,13 +50588,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -51788,7 +50657,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -51808,7 +50677,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -51819,7 +50688,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -51866,7 +50735,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -51886,7 +50755,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -51929,7 +50798,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -51938,7 +50807,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -51956,27 +50825,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -52035,9 +50907,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -52049,7 +50919,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -52081,8 +50951,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -52117,11 +50986,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -52131,10 +50997,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -52147,17 +51010,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -52177,8 +51040,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -52204,23 +51066,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -52286,7 +51146,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -52309,7 +51169,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -52360,7 +51220,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -52375,7 +51235,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -52390,7 +51250,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -52421,7 +51281,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -52455,12 +51315,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -52472,9 +51328,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -52506,7 +51361,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -52555,14 +51410,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -52584,7 +51436,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -52610,17 +51462,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -52636,13 +51485,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -52705,7 +51554,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -52725,7 +51574,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -52736,7 +51585,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -52783,7 +51632,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -52803,7 +51652,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -52846,7 +51695,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -52855,7 +51704,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -52873,27 +51722,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -52952,9 +51804,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -52966,7 +51816,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -52998,8 +51848,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -53034,11 +51883,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -53048,10 +51894,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -53064,17 +51907,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -53094,8 +51937,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -53121,23 +51963,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -53203,7 +52043,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -53226,7 +52066,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -53277,7 +52117,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -53292,7 +52132,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -53307,7 +52147,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -53338,7 +52178,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -53372,12 +52212,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -53389,9 +52225,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -53423,7 +52258,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -53472,14 +52307,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -53501,7 +52333,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -53527,17 +52359,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -53553,13 +52382,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -53622,7 +52451,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -53642,7 +52471,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -53653,7 +52482,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -53700,7 +52529,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -53720,7 +52549,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -53763,7 +52592,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -53772,7 +52601,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -53790,27 +52619,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -53869,9 +52701,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -53883,7 +52713,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -53915,8 +52745,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -53951,11 +52780,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -53965,10 +52791,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -53981,17 +52804,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -54011,8 +52834,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -54038,23 +52860,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -54120,7 +52940,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -54143,7 +52963,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -54194,7 +53014,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -54209,7 +53029,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -54224,7 +53044,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -54255,7 +53075,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -54289,12 +53109,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -54306,9 +53122,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -54340,7 +53155,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -54389,14 +53204,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -54418,7 +53230,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -54444,17 +53256,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -54470,13 +53279,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -54539,7 +53348,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -54559,7 +53368,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -54570,7 +53379,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -54617,7 +53426,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -54637,7 +53446,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -54680,7 +53489,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -54689,7 +53498,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -54707,27 +53516,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -54786,9 +53598,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -54800,7 +53610,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -54832,8 +53642,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -54868,11 +53677,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -54882,10 +53688,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -54898,17 +53701,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -54928,8 +53731,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -54955,23 +53757,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -55037,7 +53837,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -55060,7 +53860,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -55111,7 +53911,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -55126,7 +53926,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -55141,7 +53941,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -55172,7 +53972,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -55206,12 +54006,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -55223,9 +54019,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -55257,7 +54052,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -55306,14 +54101,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -55335,7 +54127,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -55361,17 +54153,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -55387,13 +54176,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -55456,7 +54245,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -55476,7 +54265,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -55487,7 +54276,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -55534,7 +54323,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -55554,7 +54343,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -55597,7 +54386,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -55606,7 +54395,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -55624,27 +54413,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -55703,9 +54495,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -55717,7 +54507,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -55749,8 +54539,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -55785,11 +54574,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -55799,10 +54585,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -55815,17 +54598,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -55845,8 +54628,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -55872,23 +54654,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -55954,7 +54734,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -55977,7 +54757,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -56028,7 +54808,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -56043,7 +54823,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -56058,7 +54838,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -56089,7 +54869,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -56123,12 +54903,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -56140,9 +54916,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -56174,7 +54949,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -56223,14 +54998,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -56252,7 +55024,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -56278,17 +55050,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -56304,13 +55073,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -56373,7 +55142,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -56393,7 +55162,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -56404,7 +55173,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -56451,7 +55220,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -56471,7 +55240,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -56514,7 +55283,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -56523,7 +55292,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -56541,27 +55310,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -56620,9 +55392,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -56634,7 +55404,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -56666,8 +55436,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -56702,11 +55471,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -56716,10 +55482,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -56732,17 +55495,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -56762,8 +55525,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -56789,23 +55551,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -56871,7 +55631,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -56894,7 +55654,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -56945,7 +55705,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -56960,7 +55720,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -56975,7 +55735,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -57006,7 +55766,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -57040,12 +55800,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -57057,9 +55813,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -57091,7 +55846,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -57140,14 +55895,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -57169,7 +55921,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -57195,17 +55947,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -57221,13 +55970,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -57290,7 +56039,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -57310,7 +56059,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -57321,7 +56070,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -57368,7 +56117,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -57388,7 +56137,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -57431,7 +56180,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -57440,7 +56189,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -57458,27 +56207,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -57537,9 +56289,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -57551,7 +56301,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -57583,8 +56333,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -57619,11 +56368,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -57633,10 +56379,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -57649,17 +56392,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -57679,8 +56422,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -57706,23 +56448,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -57788,7 +56528,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -57811,7 +56551,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -57862,7 +56602,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -57877,7 +56617,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -57892,7 +56632,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -57923,7 +56663,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -57957,12 +56697,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -57974,9 +56710,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -58008,7 +56743,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -58057,14 +56792,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -58086,7 +56818,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -58112,17 +56844,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -58138,13 +56867,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -58207,7 +56936,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -58227,7 +56956,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -58238,7 +56967,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -58285,7 +57014,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -58305,7 +57034,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -58348,7 +57077,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -58357,7 +57086,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -58375,27 +57104,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -58454,9 +57186,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -58468,7 +57198,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -58500,8 +57230,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -58536,11 +57265,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -58550,10 +57276,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -58566,17 +57289,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -58596,8 +57319,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -58623,23 +57345,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -58705,7 +57425,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -58728,7 +57448,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -58779,7 +57499,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -58794,7 +57514,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -58809,7 +57529,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -58840,7 +57560,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -58874,12 +57594,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -58891,9 +57607,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -58925,7 +57640,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -58974,14 +57689,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -59003,7 +57715,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -59029,17 +57741,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -59055,13 +57764,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -59124,7 +57833,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -59144,7 +57853,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -59155,7 +57864,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -59202,7 +57911,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -59222,7 +57931,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -59265,7 +57974,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -59274,7 +57983,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -59292,27 +58001,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -59371,9 +58083,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -59385,7 +58095,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -59417,8 +58127,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -59453,11 +58162,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -59467,10 +58173,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -59483,17 +58186,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -59513,8 +58216,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -59540,23 +58242,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -59622,7 +58322,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -59645,7 +58345,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -59696,7 +58396,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -59711,7 +58411,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -59726,7 +58426,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -59757,7 +58457,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -59791,12 +58491,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -59808,9 +58504,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -59842,7 +58537,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -59891,14 +58586,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -59920,7 +58612,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -59946,17 +58638,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -59972,13 +58661,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -60041,7 +58730,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -60061,7 +58750,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -60072,7 +58761,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -60119,7 +58808,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -60139,7 +58828,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -60182,7 +58871,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -60191,7 +58880,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -60209,27 +58898,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -60288,9 +58980,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -60302,7 +58992,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -60334,8 +59024,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -60370,11 +59059,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -60384,10 +59070,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -60400,17 +59083,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -60430,8 +59113,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -60457,23 +59139,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -60539,7 +59219,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -60562,7 +59242,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -60613,7 +59293,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -60628,7 +59308,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -60643,7 +59323,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -60674,7 +59354,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -60708,12 +59388,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -60725,9 +59401,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -60759,7 +59434,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -60808,14 +59483,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -60837,7 +59509,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -60863,17 +59535,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -60889,13 +59558,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -60958,7 +59627,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -60978,7 +59647,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -60989,7 +59658,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -61036,7 +59705,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -61056,7 +59725,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -61099,7 +59768,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -61108,7 +59777,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -61126,27 +59795,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -61205,9 +59877,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -61219,7 +59889,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -61251,8 +59921,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -61287,11 +59956,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -61301,10 +59967,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -61317,17 +59980,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -61347,8 +60010,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -61374,23 +60036,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -61456,7 +60116,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -61479,7 +60139,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -61530,7 +60190,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -61545,7 +60205,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -61560,7 +60220,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -61591,7 +60251,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -61625,12 +60285,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -61642,9 +60298,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -61676,7 +60331,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -61725,14 +60380,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -61754,7 +60406,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -61780,17 +60432,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -61806,13 +60455,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -61875,7 +60524,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -61895,7 +60544,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -61906,7 +60555,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -61953,7 +60602,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -61973,7 +60622,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -62016,7 +60665,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -62025,7 +60674,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -62043,27 +60692,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -62122,9 +60774,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -62136,7 +60786,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -62168,8 +60818,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -62204,11 +60853,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -62218,10 +60864,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -62234,17 +60877,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -62264,8 +60907,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -62291,23 +60933,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -62373,7 +61013,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -62396,7 +61036,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -62447,7 +61087,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -62462,7 +61102,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -62477,7 +61117,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -62508,7 +61148,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -62542,12 +61182,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -62559,9 +61195,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -62593,7 +61228,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -62642,14 +61277,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -62671,7 +61303,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -62697,17 +61329,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -62723,13 +61352,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -62792,7 +61421,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -62812,7 +61441,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -62823,7 +61452,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -62870,7 +61499,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -62890,7 +61519,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -62933,7 +61562,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -62942,7 +61571,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -62960,27 +61589,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -63039,9 +61671,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -63053,7 +61683,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -63085,8 +61715,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -63121,11 +61750,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -63135,10 +61761,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -63151,17 +61774,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -63181,8 +61804,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -63208,23 +61830,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -63290,7 +61910,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -63313,7 +61933,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -63364,7 +61984,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -63379,7 +61999,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -63394,7 +62014,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -63425,7 +62045,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -63459,12 +62079,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -63476,9 +62092,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -63510,7 +62125,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -63559,14 +62174,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -63588,7 +62200,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -63614,17 +62226,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -63640,13 +62249,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -63709,7 +62318,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -63729,7 +62338,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -63740,7 +62349,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -63787,7 +62396,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -63807,7 +62416,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -63850,7 +62459,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -63859,7 +62468,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -63877,27 +62486,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -63956,9 +62568,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -63970,7 +62580,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -64002,8 +62612,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -64038,11 +62647,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -64052,10 +62658,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -64068,17 +62671,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -64098,8 +62701,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -64125,23 +62727,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -64207,7 +62807,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -64230,7 +62830,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -64281,7 +62881,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -64296,7 +62896,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -64311,7 +62911,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -64342,7 +62942,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -64376,12 +62976,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -64393,9 +62989,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -64427,7 +63022,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -64476,14 +63071,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -64505,7 +63097,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -64531,17 +63123,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -64557,13 +63146,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -64626,7 +63215,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -64646,7 +63235,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -64657,7 +63246,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -64704,7 +63293,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -64724,7 +63313,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -64767,7 +63356,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -64776,7 +63365,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -64794,27 +63383,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -64873,9 +63465,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -64887,7 +63477,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -64919,8 +63509,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -64955,11 +63544,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -64969,10 +63555,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -64985,17 +63568,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -65015,8 +63598,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -65042,23 +63624,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -65124,7 +63704,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -65147,7 +63727,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -65198,7 +63778,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -65213,7 +63793,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -65228,7 +63808,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -65259,7 +63839,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -65293,12 +63873,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -65310,9 +63886,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -65344,7 +63919,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -65393,14 +63968,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -65422,7 +63994,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -65448,17 +64020,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -65474,13 +64043,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -65543,7 +64112,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -65563,7 +64132,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -65574,7 +64143,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -65621,7 +64190,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -65641,7 +64210,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -65684,7 +64253,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -65693,7 +64262,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -65711,27 +64280,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -65790,9 +64362,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -65804,7 +64374,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -65836,8 +64406,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -65872,11 +64441,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -65886,10 +64452,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -65902,17 +64465,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -65932,8 +64495,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -65959,23 +64521,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -66041,7 +64601,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -66064,7 +64624,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -66115,7 +64675,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -66130,7 +64690,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -66145,7 +64705,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -66176,7 +64736,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -66210,12 +64770,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -66227,9 +64783,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -66261,7 +64816,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -66310,14 +64865,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -66339,7 +64891,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -66365,17 +64917,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -66391,13 +64940,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -66460,7 +65009,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -66480,7 +65029,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -66491,7 +65040,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -66538,7 +65087,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -66558,7 +65107,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -66601,7 +65150,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -66610,7 +65159,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -66628,27 +65177,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -66707,9 +65259,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -66721,7 +65271,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -66753,8 +65303,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -66789,11 +65338,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -66803,10 +65349,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -66819,17 +65362,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -66849,8 +65392,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -66876,23 +65418,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -66958,7 +65498,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -66981,7 +65521,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -67032,7 +65572,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -67047,7 +65587,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -67062,7 +65602,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -67093,7 +65633,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -67127,12 +65667,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -67144,9 +65680,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -67178,7 +65713,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -67227,14 +65762,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -67256,7 +65788,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -67282,17 +65814,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -67308,13 +65837,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -67377,7 +65906,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -67397,7 +65926,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -67408,7 +65937,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -67455,7 +65984,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -67475,7 +66004,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -67518,7 +66047,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -67527,7 +66056,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -67545,27 +66074,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -67624,9 +66156,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -67638,7 +66168,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -67670,8 +66200,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -67706,11 +66235,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -67720,10 +66246,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -67736,17 +66259,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -67766,8 +66289,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -67793,23 +66315,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -67875,7 +66395,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -67898,7 +66418,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -67949,7 +66469,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -67964,7 +66484,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -67979,7 +66499,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -68010,7 +66530,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -68044,12 +66564,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -68061,9 +66577,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -68095,7 +66610,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -68144,14 +66659,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -68173,7 +66685,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -68199,17 +66711,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -68225,13 +66734,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -68294,7 +66803,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -68314,7 +66823,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -68325,7 +66834,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -68372,7 +66881,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -68392,7 +66901,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -68435,7 +66944,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -68444,7 +66953,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -68462,27 +66971,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -68541,9 +67053,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -68555,7 +67065,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -68587,8 +67097,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -68623,11 +67132,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -68637,10 +67143,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -68653,17 +67156,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -68683,8 +67186,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -68710,23 +67212,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -68792,7 +67292,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -68815,7 +67315,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -68866,7 +67366,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -68881,7 +67381,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -68896,7 +67396,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -68927,7 +67427,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -68961,12 +67461,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -68978,9 +67474,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -69012,7 +67507,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -69061,14 +67556,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -69090,7 +67582,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -69116,17 +67608,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -69142,13 +67631,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -69211,7 +67700,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -69231,7 +67720,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -69242,7 +67731,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -69289,7 +67778,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -69309,7 +67798,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -69352,7 +67841,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -69361,7 +67850,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -69379,27 +67868,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -69458,9 +67950,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -69472,7 +67962,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -69504,8 +67994,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -69540,11 +68029,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -69554,10 +68040,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -69570,17 +68053,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -69600,8 +68083,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -69627,23 +68109,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -69709,7 +68189,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -69732,7 +68212,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -69783,7 +68263,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -69798,7 +68278,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -69813,7 +68293,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -69844,7 +68324,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -69878,12 +68358,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -69895,9 +68371,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -69929,7 +68404,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -69978,14 +68453,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -70007,7 +68479,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -70033,17 +68505,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -70059,13 +68528,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -70128,7 +68597,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -70148,7 +68617,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -70159,7 +68628,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -70206,7 +68675,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -70226,7 +68695,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -70269,7 +68738,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -70278,7 +68747,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -70296,27 +68765,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -70375,9 +68847,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -70389,7 +68859,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -70421,8 +68891,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -70457,11 +68926,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -70471,10 +68937,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -70487,17 +68950,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -70517,8 +68980,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -70544,23 +69006,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -70626,7 +69086,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -70649,7 +69109,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -70700,7 +69160,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -70715,7 +69175,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -70730,7 +69190,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -70761,7 +69221,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -70795,12 +69255,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -70812,9 +69268,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -70846,7 +69301,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -70895,14 +69350,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -70924,7 +69376,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -70950,17 +69402,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -70976,13 +69425,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -71045,7 +69494,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -71065,7 +69514,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -71076,7 +69525,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -71123,7 +69572,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -71143,7 +69592,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -71186,7 +69635,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -71195,7 +69644,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -71213,27 +69662,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -71292,9 +69744,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -71306,7 +69756,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -71338,8 +69788,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -71374,11 +69823,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -71388,10 +69834,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -71404,17 +69847,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -71434,8 +69877,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -71461,23 +69903,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -71543,7 +69983,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -71566,7 +70006,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -71617,7 +70057,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -71632,7 +70072,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -71647,7 +70087,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -71678,7 +70118,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -71712,12 +70152,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -71729,9 +70165,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -71763,7 +70198,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -71812,14 +70247,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -71841,7 +70273,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -71867,17 +70299,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -71893,13 +70322,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -71962,7 +70391,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -71982,7 +70411,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -71993,7 +70422,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -72040,7 +70469,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -72060,7 +70489,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -72103,7 +70532,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -72112,7 +70541,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -72130,27 +70559,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -72209,9 +70641,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -72223,7 +70653,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -72255,8 +70685,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -72291,11 +70720,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -72305,10 +70731,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -72321,17 +70744,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -72351,8 +70774,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -72378,23 +70800,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -72460,7 +70880,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -72483,7 +70903,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -72534,7 +70954,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -72549,7 +70969,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -72564,7 +70984,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -72595,7 +71015,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -72629,12 +71049,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -72646,9 +71062,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -72680,7 +71095,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -72729,14 +71144,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -72758,7 +71170,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -72784,17 +71196,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -72810,13 +71219,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -72879,7 +71288,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -72899,7 +71308,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -72910,7 +71319,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -72957,7 +71366,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -72977,7 +71386,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -73020,7 +71429,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -73029,7 +71438,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -73047,27 +71456,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -73126,9 +71538,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -73140,7 +71550,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -73172,8 +71582,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -73208,11 +71617,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -73222,10 +71628,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -73238,17 +71641,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -73268,8 +71671,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -73295,23 +71697,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -73377,7 +71777,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -73400,7 +71800,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -73451,7 +71851,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -73466,7 +71866,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -73481,7 +71881,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -73512,7 +71912,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -73546,12 +71946,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -73563,9 +71959,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -73597,7 +71992,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -73646,14 +72041,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -73675,7 +72067,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -73701,17 +72093,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -73727,13 +72116,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -73796,7 +72185,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -73816,7 +72205,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -73827,7 +72216,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -73874,7 +72263,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -73894,7 +72283,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -73937,7 +72326,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -73946,7 +72335,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -73964,27 +72353,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -74043,9 +72435,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -74057,7 +72447,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -74089,8 +72479,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -74125,11 +72514,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -74139,10 +72525,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -74155,17 +72538,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -74185,8 +72568,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -74212,23 +72594,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -74294,7 +72674,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -74317,7 +72697,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -74368,7 +72748,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -74383,7 +72763,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -74398,7 +72778,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -74429,7 +72809,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -74463,12 +72843,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -74480,9 +72856,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -74514,7 +72889,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -74563,14 +72938,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -74592,7 +72964,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -74618,17 +72990,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -74644,13 +73013,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -74713,7 +73082,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -74733,7 +73102,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -74744,7 +73113,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -74791,7 +73160,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -74811,7 +73180,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -74854,7 +73223,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -74863,7 +73232,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -74881,27 +73250,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -74960,9 +73332,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -74974,7 +73344,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -75006,8 +73376,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -75042,11 +73411,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -75056,10 +73422,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -75072,17 +73435,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -75102,8 +73465,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -75129,23 +73491,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -75211,7 +73571,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -75234,7 +73594,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -75285,7 +73645,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -75300,7 +73660,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -75315,7 +73675,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -75346,7 +73706,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -75380,12 +73740,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -75397,9 +73753,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -75431,7 +73786,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -75480,14 +73835,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -75509,7 +73861,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -75535,17 +73887,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -75561,13 +73910,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -75630,7 +73979,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -75650,7 +73999,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -75661,7 +74010,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -75708,7 +74057,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -75728,7 +74077,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -75771,7 +74120,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -75780,7 +74129,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -75798,27 +74147,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -75877,9 +74229,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -75891,7 +74241,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -75923,8 +74273,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -75959,11 +74308,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -75973,10 +74319,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -75989,17 +74332,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -76019,8 +74362,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -76046,23 +74388,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -76128,7 +74468,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -76151,7 +74491,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -76202,7 +74542,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -76217,7 +74557,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -76232,7 +74572,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -76263,7 +74603,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -76297,12 +74637,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -76314,9 +74650,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -76348,7 +74683,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -76397,14 +74732,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -76426,7 +74758,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -76452,17 +74784,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -76478,13 +74807,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -76547,7 +74876,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -76567,7 +74896,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -76578,7 +74907,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -76625,7 +74954,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -76645,7 +74974,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -76688,7 +75017,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -76697,7 +75026,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -76715,27 +75044,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -76794,9 +75126,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -76808,7 +75138,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -76840,8 +75170,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -76876,11 +75205,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -76890,10 +75216,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -76906,17 +75229,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -76936,8 +75259,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -76963,23 +75285,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -77045,7 +75365,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -77068,7 +75388,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -77119,7 +75439,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -77134,7 +75454,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -77149,7 +75469,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -77180,7 +75500,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -77214,12 +75534,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -77231,9 +75547,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -77265,7 +75580,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -77314,14 +75629,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -77343,7 +75655,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -77369,17 +75681,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -77395,13 +75704,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -77464,7 +75773,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -77484,7 +75793,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -77495,7 +75804,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -77542,7 +75851,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -77562,7 +75871,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -77605,7 +75914,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -77614,7 +75923,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -77632,27 +75941,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -77711,9 +76023,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -77725,7 +76035,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -77757,8 +76067,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -77793,11 +76102,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -77807,10 +76113,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -77823,17 +76126,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -77853,8 +76156,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -77880,23 +76182,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -77962,7 +76262,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -77985,7 +76285,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -78036,7 +76336,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -78051,7 +76351,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -78066,7 +76366,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -78097,7 +76397,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -78131,12 +76431,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -78148,9 +76444,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -78182,7 +76477,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -78231,14 +76526,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -78260,7 +76552,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -78286,17 +76578,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -78312,13 +76601,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -78381,7 +76670,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -78401,7 +76690,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -78412,7 +76701,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -78459,7 +76748,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -78479,7 +76768,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -78522,7 +76811,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -78531,7 +76820,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -78549,27 +76838,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -78628,9 +76920,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -78642,7 +76932,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -78674,8 +76964,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -78710,11 +76999,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -78724,10 +77010,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -78740,17 +77023,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -78770,8 +77053,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -78797,23 +77079,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -78879,7 +77159,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -78902,7 +77182,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -78953,7 +77233,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -78968,7 +77248,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -78983,7 +77263,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -79014,7 +77294,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -79048,12 +77328,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -79065,9 +77341,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -79099,7 +77374,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -79148,14 +77423,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -79177,7 +77449,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -79203,17 +77475,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -79229,13 +77498,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -79298,7 +77567,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -79318,7 +77587,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -79329,7 +77598,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -79376,7 +77645,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -79396,7 +77665,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -79439,7 +77708,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -79448,7 +77717,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -79466,27 +77735,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -79545,9 +77817,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -79559,7 +77829,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -79591,8 +77861,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -79627,11 +77896,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -79641,10 +77907,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -79657,17 +77920,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -79687,8 +77950,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -79714,23 +77976,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -79796,7 +78056,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -79819,7 +78079,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -79870,7 +78130,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -79885,7 +78145,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -79900,7 +78160,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -79931,7 +78191,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -79965,12 +78225,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -79982,9 +78238,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -80016,7 +78271,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -80065,14 +78320,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -80094,7 +78346,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -80120,17 +78372,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -80146,13 +78395,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -80215,7 +78464,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -80235,7 +78484,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -80246,7 +78495,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -80293,7 +78542,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -80313,7 +78562,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -80356,7 +78605,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -80365,7 +78614,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -80383,27 +78632,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -80462,9 +78714,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -80476,7 +78726,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -80508,8 +78758,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -80544,11 +78793,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -80558,10 +78804,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -80574,17 +78817,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -80604,8 +78847,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -80631,23 +78873,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -80713,7 +78953,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -80736,7 +78976,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -80787,7 +79027,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -80802,7 +79042,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -80817,7 +79057,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -80848,7 +79088,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -80882,12 +79122,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -80899,9 +79135,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -80933,7 +79168,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -80982,14 +79217,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -81011,7 +79243,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -81037,17 +79269,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -81063,13 +79292,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -81132,7 +79361,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -81152,7 +79381,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -81163,7 +79392,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -81210,7 +79439,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -81230,7 +79459,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -81273,7 +79502,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -81282,7 +79511,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -81300,27 +79529,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -81379,9 +79611,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -81393,7 +79623,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -81425,8 +79655,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -81461,11 +79690,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -81475,10 +79701,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -81491,17 +79714,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -81521,8 +79744,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -81548,23 +79770,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -81630,7 +79850,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -81653,7 +79873,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -81704,7 +79924,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -81719,7 +79939,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -81734,7 +79954,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -81765,7 +79985,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -81799,12 +80019,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -81816,9 +80032,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -81850,7 +80065,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -81899,14 +80114,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -81928,7 +80140,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -81954,17 +80166,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -81980,13 +80189,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -82049,7 +80258,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -82069,7 +80278,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -82080,7 +80289,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -82127,7 +80336,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -82147,7 +80356,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -82190,7 +80399,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -82199,7 +80408,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -82217,27 +80426,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -82296,9 +80508,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -82310,7 +80520,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -82342,8 +80552,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -82378,11 +80587,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -82392,10 +80598,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -82408,17 +80611,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -82438,8 +80641,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -82465,23 +80667,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -82547,7 +80747,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -82570,7 +80770,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -82621,7 +80821,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -82636,7 +80836,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -82651,7 +80851,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -82682,7 +80882,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -82716,12 +80916,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -82733,9 +80929,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -82767,7 +80962,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -82816,14 +81011,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -82845,7 +81037,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -82871,17 +81063,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -82897,13 +81086,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -82966,7 +81155,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -82986,7 +81175,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -82997,7 +81186,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -83044,7 +81233,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -83064,7 +81253,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -83107,7 +81296,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -83116,7 +81305,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -83134,27 +81323,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -83213,9 +81405,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -83227,7 +81417,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -83259,8 +81449,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -83295,11 +81484,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -83309,10 +81495,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -83325,17 +81508,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -83355,8 +81538,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -83382,23 +81564,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -83464,7 +81644,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -83487,7 +81667,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -83538,7 +81718,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -83553,7 +81733,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -83568,7 +81748,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -83599,7 +81779,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -83633,12 +81813,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -83650,9 +81826,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -83684,7 +81859,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -83733,14 +81908,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -83762,7 +81934,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -83788,17 +81960,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -83814,13 +81983,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -83883,7 +82052,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -83903,7 +82072,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -83914,7 +82083,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -83961,7 +82130,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -83981,7 +82150,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -84024,7 +82193,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -84033,7 +82202,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -84051,27 +82220,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -84130,9 +82302,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -84144,7 +82314,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -84176,8 +82346,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -84212,11 +82381,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -84226,10 +82392,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -84242,17 +82405,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -84272,8 +82435,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -84299,23 +82461,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -84381,7 +82541,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -84404,7 +82564,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -84455,7 +82615,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -84470,7 +82630,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -84485,7 +82645,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -84516,7 +82676,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -84550,12 +82710,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -84567,9 +82723,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -84601,7 +82756,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -84650,14 +82805,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -84679,7 +82831,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -84705,17 +82857,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -84731,13 +82880,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -84800,7 +82949,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -84820,7 +82969,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -84831,7 +82980,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -84878,7 +83027,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -84898,7 +83047,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -84941,7 +83090,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -84950,7 +83099,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -84968,27 +83117,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -85047,9 +83199,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -85061,7 +83211,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -85093,8 +83243,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -85129,11 +83278,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -85143,10 +83289,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -85159,17 +83302,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -85189,8 +83332,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -85216,23 +83358,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -85298,7 +83438,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -85321,7 +83461,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -85372,7 +83512,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -85387,7 +83527,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -85402,7 +83542,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -85433,7 +83573,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -85467,12 +83607,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -85484,9 +83620,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -85518,7 +83653,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -85567,14 +83702,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -85596,7 +83728,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -85622,17 +83754,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -85648,13 +83777,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -85717,7 +83846,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -85737,7 +83866,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -85748,7 +83877,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -85795,7 +83924,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -85815,7 +83944,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -85858,7 +83987,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -85867,7 +83996,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -85885,27 +84014,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -85964,9 +84096,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -85978,7 +84108,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -86010,8 +84140,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -86046,11 +84175,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -86060,10 +84186,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -86076,17 +84199,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -86106,8 +84229,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -86133,23 +84255,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -86215,7 +84335,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -86238,7 +84358,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -86289,7 +84409,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -86304,7 +84424,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -86319,7 +84439,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -86350,7 +84470,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -86384,12 +84504,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -86401,9 +84517,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -86435,7 +84550,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -86484,14 +84599,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -86513,7 +84625,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -86539,17 +84651,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -86565,13 +84674,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -86634,7 +84743,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -86654,7 +84763,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -86665,7 +84774,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -86712,7 +84821,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -86732,7 +84841,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -86775,7 +84884,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -86784,7 +84893,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -86802,27 +84911,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -86881,9 +84993,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -86895,7 +85005,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -86927,8 +85037,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -86963,11 +85072,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -86977,10 +85083,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -86993,17 +85096,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -87023,8 +85126,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -87050,23 +85152,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -87132,7 +85232,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -87155,7 +85255,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -87206,7 +85306,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -87221,7 +85321,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -87236,7 +85336,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -87267,7 +85367,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -87301,12 +85401,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -87318,9 +85414,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -87352,7 +85447,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -87401,14 +85496,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -87430,7 +85522,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -87456,17 +85548,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -87482,13 +85571,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -87551,7 +85640,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -87571,7 +85660,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -87582,7 +85671,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -87629,7 +85718,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -87649,7 +85738,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -87692,7 +85781,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -87701,7 +85790,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -87719,27 +85808,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -87798,9 +85890,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -87812,7 +85902,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -87844,8 +85934,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -87880,11 +85969,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -87894,10 +85980,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -87910,17 +85993,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -87940,8 +86023,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -87967,23 +86049,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -88049,7 +86129,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -88072,7 +86152,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -88123,7 +86203,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -88138,7 +86218,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -88153,7 +86233,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -88184,7 +86264,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -88218,12 +86298,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -88235,9 +86311,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -88269,7 +86344,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -88318,14 +86393,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -88347,7 +86419,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -88373,17 +86445,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -88399,13 +86468,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -88468,7 +86537,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -88488,7 +86557,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -88499,7 +86568,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -88546,7 +86615,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -88566,7 +86635,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -88609,7 +86678,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -88618,7 +86687,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -88636,27 +86705,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -88715,9 +86787,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -88729,7 +86799,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -88761,8 +86831,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -88797,11 +86866,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -88811,10 +86877,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -88827,17 +86890,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -88857,8 +86920,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -88884,23 +86946,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -88966,7 +87026,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -88989,7 +87049,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -89040,7 +87100,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -89055,7 +87115,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -89070,7 +87130,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -89101,7 +87161,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -89135,12 +87195,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -89152,9 +87208,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -89186,7 +87241,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -89235,14 +87290,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -89264,7 +87316,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -89290,17 +87342,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -89316,13 +87365,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -89385,7 +87434,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -89405,7 +87454,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -89416,7 +87465,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -89463,7 +87512,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -89483,7 +87532,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -89526,7 +87575,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -89535,7 +87584,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -89553,27 +87602,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -89632,9 +87684,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -89646,7 +87696,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -89678,8 +87728,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -89714,11 +87763,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -89728,10 +87774,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -89744,17 +87787,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -89774,8 +87817,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -89801,23 +87843,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -89883,7 +87923,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -89906,7 +87946,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -89957,7 +87997,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -89972,7 +88012,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -89987,7 +88027,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -90018,7 +88058,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -90052,12 +88092,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -90069,9 +88105,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -90103,7 +88138,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -90152,14 +88187,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -90181,7 +88213,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -90207,17 +88239,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -90233,13 +88262,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -90302,7 +88331,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -90322,7 +88351,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -90333,7 +88362,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -90380,7 +88409,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -90400,7 +88429,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -90443,7 +88472,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -90452,7 +88481,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -90470,27 +88499,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -90549,9 +88581,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -90563,7 +88593,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -90595,8 +88625,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -90631,11 +88660,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -90645,10 +88671,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -90661,17 +88684,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -90691,8 +88714,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -90718,23 +88740,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -90800,7 +88820,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -90823,7 +88843,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -90874,7 +88894,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -90889,7 +88909,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -90904,7 +88924,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -90935,7 +88955,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -90969,12 +88989,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -90986,9 +89002,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -91020,7 +89035,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -91069,14 +89084,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -91098,7 +89110,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -91124,17 +89136,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -91150,13 +89159,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -91219,7 +89228,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -91239,7 +89248,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -91250,7 +89259,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -91297,7 +89306,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -91317,7 +89326,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -91360,7 +89369,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -91369,7 +89378,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -91387,27 +89396,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -91466,9 +89478,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -91480,7 +89490,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -91512,8 +89522,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -91548,11 +89557,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -91562,10 +89568,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -91578,17 +89581,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -91608,8 +89611,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -91635,23 +89637,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -91717,7 +89717,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -91740,7 +89740,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -91791,7 +89791,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -91806,7 +89806,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -91821,7 +89821,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -91852,7 +89852,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -91886,12 +89886,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -91903,9 +89899,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -91937,7 +89932,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -91986,14 +89981,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -92015,7 +90007,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -92041,17 +90033,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -92067,13 +90056,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -92136,7 +90125,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -92156,7 +90145,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -92167,7 +90156,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -92214,7 +90203,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -92234,7 +90223,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -92277,7 +90266,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -92286,7 +90275,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -92304,27 +90293,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -92383,9 +90375,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -92397,7 +90387,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -92429,8 +90419,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -92465,11 +90454,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -92479,10 +90465,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -92495,17 +90478,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -92525,8 +90508,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -92552,23 +90534,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -92634,7 +90614,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -92657,7 +90637,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -92708,7 +90688,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -92723,7 +90703,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -92738,7 +90718,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -92769,7 +90749,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -92803,12 +90783,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -92820,9 +90796,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -92854,7 +90829,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -92903,14 +90878,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -92932,7 +90904,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -92958,17 +90930,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -92984,13 +90953,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -93053,7 +91022,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -93073,7 +91042,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -93084,7 +91053,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -93131,7 +91100,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -93151,7 +91120,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -93194,7 +91163,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -93203,7 +91172,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -93221,27 +91190,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -93300,9 +91272,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -93314,7 +91284,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -93346,8 +91316,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -93382,11 +91351,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -93396,10 +91362,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -93412,17 +91375,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -93442,8 +91405,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -93469,23 +91431,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -93551,7 +91511,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -93574,7 +91534,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -93625,7 +91585,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -93640,7 +91600,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -93655,7 +91615,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -93686,7 +91646,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -93720,12 +91680,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -93737,9 +91693,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -93771,7 +91726,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -93820,14 +91775,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -93849,7 +91801,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -93875,17 +91827,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -93901,13 +91850,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -93970,7 +91919,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -93990,7 +91939,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -94001,7 +91950,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -94048,7 +91997,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -94068,7 +92017,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -94111,7 +92060,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -94120,7 +92069,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -94138,27 +92087,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -94217,9 +92169,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -94231,7 +92181,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -94263,8 +92213,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -94299,11 +92248,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -94313,10 +92259,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -94329,17 +92272,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -94359,8 +92302,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -94386,23 +92328,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -94468,7 +92408,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -94491,7 +92431,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -94542,7 +92482,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -94557,7 +92497,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -94572,7 +92512,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -94603,7 +92543,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -94637,12 +92577,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -94654,9 +92590,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -94688,7 +92623,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -94737,14 +92672,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -94766,7 +92698,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -94792,17 +92724,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -94818,13 +92747,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -94887,7 +92816,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -94907,7 +92836,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -94918,7 +92847,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -94965,7 +92894,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -94985,7 +92914,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -95028,7 +92957,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -95037,7 +92966,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -95055,27 +92984,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -95134,9 +93066,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -95148,7 +93078,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -95180,8 +93110,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -95216,11 +93145,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -95230,10 +93156,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -95246,17 +93169,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -95276,8 +93199,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -95303,23 +93225,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -95385,7 +93305,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -95408,7 +93328,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -95459,7 +93379,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -95474,7 +93394,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -95489,7 +93409,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -95520,7 +93440,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -95554,12 +93474,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -95571,9 +93487,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -95605,7 +93520,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -95654,14 +93569,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -95683,7 +93595,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -95709,17 +93621,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -95735,13 +93644,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -95804,7 +93713,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -95824,7 +93733,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -95835,7 +93744,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -95882,7 +93791,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -95902,7 +93811,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -95945,7 +93854,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -95954,7 +93863,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -95972,27 +93881,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -96051,9 +93963,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -96065,7 +93975,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -96097,8 +94007,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -96133,11 +94042,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -96147,10 +94053,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -96163,17 +94066,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -96193,8 +94096,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -96220,23 +94122,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -96302,7 +94202,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -96325,7 +94225,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -96376,7 +94276,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -96391,7 +94291,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -96406,7 +94306,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -96437,7 +94337,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -96471,12 +94371,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -96488,9 +94384,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -96522,7 +94417,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -96571,14 +94466,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -96600,7 +94492,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -96626,17 +94518,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -96652,13 +94541,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -96721,7 +94610,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -96741,7 +94630,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -96752,7 +94641,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -96799,7 +94688,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -96819,7 +94708,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -96862,7 +94751,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -96871,7 +94760,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -96889,27 +94778,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -96968,9 +94860,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -96982,7 +94872,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -97014,8 +94904,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -97050,11 +94939,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -97064,10 +94950,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -97080,17 +94963,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -97110,8 +94993,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -97137,23 +95019,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -97219,7 +95099,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -97242,7 +95122,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -97293,7 +95173,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -97308,7 +95188,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -97323,7 +95203,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -97354,7 +95234,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -97388,12 +95268,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -97405,9 +95281,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -97439,7 +95314,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -97488,14 +95363,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -97517,7 +95389,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -97543,17 +95415,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -97569,13 +95438,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -97638,7 +95507,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -97658,7 +95527,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -97669,7 +95538,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -97716,7 +95585,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -97736,7 +95605,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -97779,7 +95648,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -97788,7 +95657,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -97806,27 +95675,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -97885,9 +95757,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -97899,7 +95769,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -97931,8 +95801,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -97967,11 +95836,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -97981,10 +95847,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -97997,17 +95860,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -98027,8 +95890,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -98054,23 +95916,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -98136,7 +95996,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -98159,7 +96019,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -98210,7 +96070,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -98225,7 +96085,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -98240,7 +96100,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -98271,7 +96131,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -98305,12 +96165,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -98322,9 +96178,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -98356,7 +96211,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -98405,14 +96260,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -98434,7 +96286,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -98460,17 +96312,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -98486,13 +96335,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -98555,7 +96404,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -98575,7 +96424,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -98586,7 +96435,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -98633,7 +96482,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -98653,7 +96502,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -98696,7 +96545,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -98705,7 +96554,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -98723,27 +96572,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -98802,9 +96654,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -98816,7 +96666,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -98848,8 +96698,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -98884,11 +96733,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -98898,10 +96744,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -98914,17 +96757,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -98944,8 +96787,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -98971,23 +96813,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -99053,7 +96893,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -99076,7 +96916,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -99127,7 +96967,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -99142,7 +96982,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -99157,7 +96997,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -99188,7 +97028,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -99222,12 +97062,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -99239,9 +97075,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -99273,7 +97108,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -99322,14 +97157,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -99351,7 +97183,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -99377,17 +97209,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -99403,13 +97232,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -99472,7 +97301,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -99492,7 +97321,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -99503,7 +97332,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -99550,7 +97379,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -99570,7 +97399,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -99613,7 +97442,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -99622,7 +97451,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -99640,27 +97469,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -99719,9 +97551,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -99733,7 +97563,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -99765,8 +97595,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -99801,11 +97630,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -99815,10 +97641,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -99831,17 +97654,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -99861,8 +97684,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -99888,23 +97710,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -99970,7 +97790,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -99993,7 +97813,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -100044,7 +97864,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -100059,7 +97879,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -100074,7 +97894,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -100105,7 +97925,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -100139,12 +97959,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -100156,9 +97972,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -100190,7 +98005,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -100239,14 +98054,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -100268,7 +98080,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -100294,17 +98106,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -100320,13 +98129,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -100389,7 +98198,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -100409,7 +98218,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -100420,7 +98229,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -100467,7 +98276,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -100487,7 +98296,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -100530,7 +98339,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -100539,7 +98348,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -100557,27 +98366,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -100636,9 +98448,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -100650,7 +98460,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -100682,8 +98492,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -100718,11 +98527,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -100732,10 +98538,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -100748,17 +98551,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -100778,8 +98581,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -100805,23 +98607,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -100887,7 +98687,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -100910,7 +98710,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -100961,7 +98761,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -100976,7 +98776,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -100991,7 +98791,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -101022,7 +98822,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -101056,12 +98856,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -101073,9 +98869,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -101107,7 +98902,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -101156,14 +98951,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -101185,7 +98977,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -101211,17 +99003,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -101237,13 +99026,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -101306,7 +99095,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -101326,7 +99115,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -101337,7 +99126,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -101384,7 +99173,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -101404,7 +99193,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -101447,7 +99236,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -101456,7 +99245,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -101474,27 +99263,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -101553,9 +99345,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -101567,7 +99357,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -101599,8 +99389,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -101635,11 +99424,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -101649,10 +99435,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -101665,17 +99448,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -101695,8 +99478,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -101722,23 +99504,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -101804,7 +99584,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -101827,7 +99607,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -101878,7 +99658,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -101893,7 +99673,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -101908,7 +99688,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -101939,7 +99719,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -101973,12 +99753,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -101990,9 +99766,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -102024,7 +99799,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -102073,14 +99848,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -102102,7 +99874,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -102128,17 +99900,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -102154,13 +99923,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -102223,7 +99992,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -102243,7 +100012,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -102254,7 +100023,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -102301,7 +100070,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -102321,7 +100090,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -102364,7 +100133,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -102373,7 +100142,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -102391,27 +100160,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -102470,9 +100242,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -102484,7 +100254,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -102516,8 +100286,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -102552,11 +100321,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -102566,10 +100332,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -102582,17 +100345,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -102612,8 +100375,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -102639,23 +100401,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -102721,7 +100481,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -102744,7 +100504,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -102795,7 +100555,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -102810,7 +100570,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -102825,7 +100585,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -102856,7 +100616,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -102890,12 +100650,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -102907,9 +100663,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -102941,7 +100696,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -102990,14 +100745,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -103019,7 +100771,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -103045,17 +100797,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -103071,13 +100820,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -103140,7 +100889,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -103160,7 +100909,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -103171,7 +100920,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -103218,7 +100967,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -103238,7 +100987,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -103281,7 +101030,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -103290,7 +101039,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -103308,27 +101057,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -103387,9 +101139,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -103401,7 +101151,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -103433,8 +101183,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -103469,11 +101218,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -103483,10 +101229,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -103499,17 +101242,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -103529,8 +101272,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -103556,23 +101298,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -103638,7 +101378,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -103661,7 +101401,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -103712,7 +101452,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -103727,7 +101467,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -103742,7 +101482,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -103773,7 +101513,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -103807,12 +101547,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -103824,9 +101560,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -103858,7 +101593,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -103907,14 +101642,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -103936,7 +101668,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -103962,17 +101694,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -103988,13 +101717,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -104057,7 +101786,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -104077,7 +101806,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -104088,7 +101817,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -104135,7 +101864,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -104155,7 +101884,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -104198,7 +101927,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -104207,7 +101936,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -104225,27 +101954,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -104304,9 +102036,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -104318,7 +102048,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -104350,8 +102080,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -104386,11 +102115,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -104400,10 +102126,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -104416,17 +102139,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -104446,8 +102169,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -104473,23 +102195,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -104555,7 +102275,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -104578,7 +102298,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -104629,7 +102349,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -104644,7 +102364,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -104659,7 +102379,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -104690,7 +102410,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -104724,12 +102444,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -104741,9 +102457,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -104775,7 +102490,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -104824,14 +102539,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -104853,7 +102565,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -104879,17 +102591,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -104905,13 +102614,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -104974,7 +102683,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -104994,7 +102703,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -105005,7 +102714,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -105052,7 +102761,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -105072,7 +102781,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -105115,7 +102824,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -105124,7 +102833,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -105142,27 +102851,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -105221,9 +102933,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -105235,7 +102945,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -105267,8 +102977,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -105303,11 +103012,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -105317,10 +103023,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -105333,17 +103036,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -105363,8 +103066,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -105390,23 +103092,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -105472,7 +103172,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -105495,7 +103195,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -105546,7 +103246,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -105561,7 +103261,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -105576,7 +103276,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -105607,7 +103307,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -105641,12 +103341,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -105658,9 +103354,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -105692,7 +103387,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -105741,14 +103436,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -105770,7 +103462,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -105796,17 +103488,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -105822,13 +103511,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -105891,7 +103580,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -105911,7 +103600,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -105922,7 +103611,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -105969,7 +103658,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -105989,7 +103678,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -106032,7 +103721,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -106041,7 +103730,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -106059,27 +103748,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -106138,9 +103830,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -106152,7 +103842,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -106184,8 +103874,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -106220,11 +103909,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -106234,10 +103920,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -106250,17 +103933,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -106280,8 +103963,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -106307,23 +103989,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -106389,7 +104069,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -106412,7 +104092,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -106463,7 +104143,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -106478,7 +104158,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -106493,7 +104173,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -106524,7 +104204,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -106558,12 +104238,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -106575,9 +104251,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -106609,7 +104284,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -106658,14 +104333,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -106687,7 +104359,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -106713,17 +104385,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -106739,13 +104408,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -106808,7 +104477,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -106828,7 +104497,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -106839,7 +104508,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -106886,7 +104555,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -106906,7 +104575,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -106949,7 +104618,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -106958,7 +104627,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -106976,27 +104645,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -107055,9 +104727,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -107069,7 +104739,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -107101,8 +104771,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -107137,11 +104806,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -107151,10 +104817,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -107167,17 +104830,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -107197,8 +104860,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -107224,23 +104886,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -107306,7 +104966,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -107329,7 +104989,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -107380,7 +105040,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -107395,7 +105055,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -107410,7 +105070,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -107441,7 +105101,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -107475,12 +105135,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -107492,9 +105148,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -107526,7 +105181,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -107575,14 +105230,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -107604,7 +105256,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -107630,17 +105282,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -107656,13 +105305,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -107725,7 +105374,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -107745,7 +105394,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -107756,7 +105405,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -107803,7 +105452,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -107823,7 +105472,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -107866,7 +105515,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -107875,7 +105524,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -107893,27 +105542,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -107972,9 +105624,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -107986,7 +105636,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -108018,8 +105668,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -108054,11 +105703,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -108068,10 +105714,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -108084,17 +105727,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -108114,8 +105757,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -108141,23 +105783,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -108223,7 +105863,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -108246,7 +105886,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -108297,7 +105937,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -108312,7 +105952,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -108327,7 +105967,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -108358,7 +105998,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -108392,12 +106032,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -108409,9 +106045,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -108443,7 +106078,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -108492,14 +106127,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -108521,7 +106153,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -108547,17 +106179,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -108573,13 +106202,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -108642,7 +106271,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -108662,7 +106291,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -108673,7 +106302,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -108720,7 +106349,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -108740,7 +106369,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -108783,7 +106412,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -108792,7 +106421,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -108810,27 +106439,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -108889,9 +106521,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -108903,7 +106533,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -108935,8 +106565,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -108971,11 +106600,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -108985,10 +106611,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -109001,17 +106624,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -109031,8 +106654,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -109058,23 +106680,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -109140,7 +106760,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -109163,7 +106783,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -109214,7 +106834,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -109229,7 +106849,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -109244,7 +106864,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -109275,7 +106895,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -109309,12 +106929,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -109326,9 +106942,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -109360,7 +106975,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -109409,14 +107024,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -109438,7 +107050,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -109464,17 +107076,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -109490,13 +107099,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -109559,7 +107168,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -109579,7 +107188,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -109590,7 +107199,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -109637,7 +107246,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -109657,7 +107266,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -109700,7 +107309,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -109709,7 +107318,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -109727,27 +107336,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -109806,9 +107418,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -109820,7 +107430,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -109852,8 +107462,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -109888,11 +107497,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -109902,10 +107508,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -109918,17 +107521,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -109948,8 +107551,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -109975,23 +107577,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -110057,7 +107657,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -110080,7 +107680,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -110131,7 +107731,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -110146,7 +107746,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -110161,7 +107761,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -110192,7 +107792,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -110226,12 +107826,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -110243,9 +107839,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -110277,7 +107872,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -110326,14 +107921,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -110355,7 +107947,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -110381,17 +107973,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -110407,13 +107996,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -110476,7 +108065,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -110496,7 +108085,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -110507,7 +108096,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -110554,7 +108143,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -110574,7 +108163,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -110617,7 +108206,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -110626,7 +108215,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -110644,27 +108233,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -110723,9 +108315,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -110737,7 +108327,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -110769,8 +108359,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -110805,11 +108394,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -110819,10 +108405,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -110835,17 +108418,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -110865,8 +108448,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -110892,23 +108474,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -110974,7 +108554,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -110997,7 +108577,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -111048,7 +108628,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -111063,7 +108643,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -111078,7 +108658,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -111109,7 +108689,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -111143,12 +108723,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -111160,9 +108736,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -111194,7 +108769,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -111243,14 +108818,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -111272,7 +108844,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -111298,17 +108870,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -111324,13 +108893,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -111393,7 +108962,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -111413,7 +108982,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -111424,7 +108993,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -111471,7 +109040,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -111491,7 +109060,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -111534,7 +109103,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -111543,7 +109112,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -111561,27 +109130,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -111640,9 +109212,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -111654,7 +109224,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -111686,8 +109256,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -111722,11 +109291,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -111736,10 +109302,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -111752,17 +109315,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -111782,8 +109345,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -111809,23 +109371,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -111891,7 +109451,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -111914,7 +109474,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -111965,7 +109525,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -111980,7 +109540,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -111995,7 +109555,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -112026,7 +109586,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -112060,12 +109620,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -112077,9 +109633,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -112111,7 +109666,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -112160,14 +109715,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -112189,7 +109741,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -112215,17 +109767,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -112241,13 +109790,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -112310,7 +109859,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -112330,7 +109879,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -112341,7 +109890,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -112388,7 +109937,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -112408,7 +109957,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -112451,7 +110000,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -112460,7 +110009,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -112478,27 +110027,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -112557,9 +110109,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -112571,7 +110121,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -112603,8 +110153,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -112639,11 +110188,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -112653,10 +110199,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -112669,17 +110212,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -112699,8 +110242,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -112726,23 +110268,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -112808,7 +110348,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -112831,7 +110371,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -112882,7 +110422,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -112897,7 +110437,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -112912,7 +110452,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -112943,7 +110483,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -112977,12 +110517,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -112994,9 +110530,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -113028,7 +110563,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -113077,14 +110612,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -113106,7 +110638,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -113132,17 +110664,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -113158,13 +110687,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -113227,7 +110756,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -113247,7 +110776,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -113258,7 +110787,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -113305,7 +110834,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -113325,7 +110854,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -113368,7 +110897,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -113377,7 +110906,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -113395,27 +110924,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -113474,9 +111006,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -113488,7 +111018,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -113520,8 +111050,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -113556,11 +111085,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -113570,10 +111096,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -113586,17 +111109,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -113616,8 +111139,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -113643,23 +111165,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -113725,7 +111245,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -113748,7 +111268,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -113799,7 +111319,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -113814,7 +111334,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -113829,7 +111349,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -113860,7 +111380,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -113894,12 +111414,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -113911,9 +111427,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -113945,7 +111460,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -113994,14 +111509,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -114023,7 +111535,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -114049,17 +111561,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -114075,13 +111584,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -114144,7 +111653,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -114164,7 +111673,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -114175,7 +111684,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -114222,7 +111731,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -114242,7 +111751,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -114285,7 +111794,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -114294,7 +111803,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -114312,27 +111821,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -114391,9 +111903,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -114405,7 +111915,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -114437,8 +111947,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -114473,11 +111982,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -114487,10 +111993,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -114503,17 +112006,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -114533,8 +112036,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -114560,23 +112062,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -114642,7 +112142,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -114665,7 +112165,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -114716,7 +112216,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -114731,7 +112231,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -114746,7 +112246,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -114777,7 +112277,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -114811,12 +112311,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -114828,9 +112324,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -114862,7 +112357,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -114911,14 +112406,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -114940,7 +112432,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -114966,17 +112458,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -114992,13 +112481,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -115061,7 +112550,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -115081,7 +112570,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -115092,7 +112581,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -115139,7 +112628,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -115159,7 +112648,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -115202,7 +112691,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -115211,7 +112700,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -115229,27 +112718,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -115308,9 +112800,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -115322,7 +112812,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -115354,8 +112844,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -115390,11 +112879,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -115404,10 +112890,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -115420,17 +112903,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -115450,8 +112933,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -115477,23 +112959,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -115559,7 +113039,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -115582,7 +113062,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -115633,7 +113113,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -115648,7 +113128,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -115663,7 +113143,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -115694,7 +113174,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -115728,12 +113208,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -115745,9 +113221,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -115779,7 +113254,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -115828,14 +113303,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -115857,7 +113329,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -115883,17 +113355,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -115909,13 +113378,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -115978,7 +113447,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -115998,7 +113467,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -116009,7 +113478,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -116056,7 +113525,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -116076,7 +113545,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -116119,7 +113588,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -116128,7 +113597,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -116146,27 +113615,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -116225,9 +113697,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -116239,7 +113709,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -116271,8 +113741,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -116307,11 +113776,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -116321,10 +113787,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -116337,17 +113800,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -116367,8 +113830,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -116394,23 +113856,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -116476,7 +113936,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -116499,7 +113959,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -116550,7 +114010,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -116565,7 +114025,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -116580,7 +114040,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -116611,7 +114071,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -116645,12 +114105,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -116662,9 +114118,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -116696,7 +114151,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -116745,14 +114200,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -116774,7 +114226,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -116800,17 +114252,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -116826,13 +114275,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -116895,7 +114344,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -116915,7 +114364,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -116926,7 +114375,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -116973,7 +114422,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -116993,7 +114442,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -117036,7 +114485,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -117045,7 +114494,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -117063,27 +114512,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -117142,9 +114594,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -117156,7 +114606,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -117188,8 +114638,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -117224,11 +114673,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -117238,10 +114684,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -117254,17 +114697,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -117284,8 +114727,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -117311,23 +114753,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -117393,7 +114833,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -117416,7 +114856,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -117467,7 +114907,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -117482,7 +114922,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -117497,7 +114937,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -117528,7 +114968,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -117562,12 +115002,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -117579,9 +115015,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -117613,7 +115048,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -117662,14 +115097,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -117691,7 +115123,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -117717,17 +115149,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -117743,13 +115172,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -117812,7 +115241,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -117832,7 +115261,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -117843,7 +115272,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -117890,7 +115319,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -117910,7 +115339,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -117953,7 +115382,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -117962,7 +115391,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -117980,27 +115409,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -118059,9 +115491,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -118073,7 +115503,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -118105,8 +115535,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -118141,11 +115570,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -118155,10 +115581,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -118171,17 +115594,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -118201,8 +115624,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -118228,23 +115650,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -118310,7 +115730,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -118333,7 +115753,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -118384,7 +115804,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -118399,7 +115819,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -118414,7 +115834,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -118445,7 +115865,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -118479,12 +115899,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -118496,9 +115912,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -118530,7 +115945,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -118579,14 +115994,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -118608,7 +116020,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -118634,17 +116046,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -118660,13 +116069,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -118729,7 +116138,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -118749,7 +116158,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -118760,7 +116169,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -118807,7 +116216,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -118827,7 +116236,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -118870,7 +116279,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -118879,7 +116288,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -118897,27 +116306,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -118976,9 +116388,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -118990,7 +116400,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -119022,8 +116432,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -119058,11 +116467,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -119072,10 +116478,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -119088,17 +116491,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -119118,8 +116521,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -119145,23 +116547,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -119227,7 +116627,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -119250,7 +116650,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -119301,7 +116701,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -119316,7 +116716,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -119331,7 +116731,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -119362,7 +116762,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -119396,12 +116796,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -119413,9 +116809,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -119447,7 +116842,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -119496,14 +116891,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -119525,7 +116917,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -119551,17 +116943,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -119577,13 +116966,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -119646,7 +117035,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -119666,7 +117055,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -119677,7 +117066,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -119724,7 +117113,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -119744,7 +117133,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -119787,7 +117176,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -119796,7 +117185,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -119814,27 +117203,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -119893,9 +117285,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -119907,7 +117297,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -119939,8 +117329,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -119975,11 +117364,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -119989,10 +117375,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -120005,17 +117388,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -120035,8 +117418,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -120062,23 +117444,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -120144,7 +117524,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -120167,7 +117547,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -120218,7 +117598,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -120233,7 +117613,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -120248,7 +117628,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -120279,7 +117659,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -120313,12 +117693,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -120330,9 +117706,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -120364,7 +117739,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -120413,14 +117788,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -120442,7 +117814,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -120468,17 +117840,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -120494,13 +117863,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -120563,7 +117932,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -120583,7 +117952,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -120594,7 +117963,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -120641,7 +118010,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -120661,7 +118030,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -120704,7 +118073,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -120713,7 +118082,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -120731,27 +118100,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -120810,9 +118182,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -120824,7 +118194,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -120856,8 +118226,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -120892,11 +118261,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -120906,10 +118272,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -120922,17 +118285,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -120952,8 +118315,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -120979,23 +118341,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -121061,7 +118421,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -121084,7 +118444,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -121135,7 +118495,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -121150,7 +118510,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -121165,7 +118525,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -121196,7 +118556,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -121230,12 +118590,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -121247,9 +118603,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -121281,7 +118636,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -121330,14 +118685,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -121359,7 +118711,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -121385,17 +118737,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -121411,13 +118760,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -121480,7 +118829,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -121500,7 +118849,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -121511,7 +118860,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -121558,7 +118907,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -121578,7 +118927,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -121621,7 +118970,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -121630,7 +118979,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -121648,27 +118997,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -121727,9 +119079,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -121741,7 +119091,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -121773,8 +119123,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -121809,11 +119158,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -121823,10 +119169,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -121839,17 +119182,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -121869,8 +119212,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -121896,23 +119238,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -121978,7 +119318,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -122001,7 +119341,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -122052,7 +119392,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -122067,7 +119407,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -122082,7 +119422,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -122113,7 +119453,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -122147,12 +119487,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -122164,9 +119500,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -122198,7 +119533,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -122247,14 +119582,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -122276,7 +119608,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -122302,17 +119634,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -122328,13 +119657,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -122397,7 +119726,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -122417,7 +119746,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -122428,7 +119757,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -122475,7 +119804,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -122495,7 +119824,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -122538,7 +119867,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -122547,7 +119876,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -122565,27 +119894,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -122644,9 +119976,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -122658,7 +119988,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -122690,8 +120020,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -122726,11 +120055,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -122740,10 +120066,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -122756,17 +120079,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -122786,8 +120109,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -122813,23 +120135,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -122895,7 +120215,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -122918,7 +120238,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -122969,7 +120289,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -122984,7 +120304,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -122999,7 +120319,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -123030,7 +120350,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -123064,12 +120384,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -123081,9 +120397,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -123115,7 +120430,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -123164,14 +120479,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -123193,7 +120505,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -123219,17 +120531,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -123245,13 +120554,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -123314,7 +120623,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -123334,7 +120643,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -123345,7 +120654,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -123392,7 +120701,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -123412,7 +120721,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -123455,7 +120764,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -123464,7 +120773,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -123482,27 +120791,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -123561,9 +120873,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -123575,7 +120885,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -123607,8 +120917,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -123643,11 +120952,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -123657,10 +120963,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -123673,17 +120976,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -123703,8 +121006,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -123730,23 +121032,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -123812,7 +121112,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -123835,7 +121135,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -123886,7 +121186,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -123901,7 +121201,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -123916,7 +121216,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -123947,7 +121247,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -123981,12 +121281,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -123998,9 +121294,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -124032,7 +121327,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -124081,14 +121376,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -124110,7 +121402,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -124136,17 +121428,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -124162,13 +121451,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -124231,7 +121520,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -124251,7 +121540,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -124262,7 +121551,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -124309,7 +121598,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -124329,7 +121618,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -124372,7 +121661,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -124381,7 +121670,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -124399,27 +121688,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -124478,9 +121770,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -124492,7 +121782,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -124524,8 +121814,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -124560,11 +121849,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -124574,10 +121860,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -124590,17 +121873,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -124620,8 +121903,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -124647,23 +121929,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -124729,7 +122009,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -124752,7 +122032,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -124803,7 +122083,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -124818,7 +122098,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -124833,7 +122113,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -124864,7 +122144,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -124898,12 +122178,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -124915,9 +122191,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -124949,7 +122224,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -124998,14 +122273,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -125027,7 +122299,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -125053,17 +122325,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -125079,13 +122348,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -125148,7 +122417,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -125168,7 +122437,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -125179,7 +122448,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -125226,7 +122495,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -125246,7 +122515,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -125289,7 +122558,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -125298,7 +122567,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -125316,27 +122585,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -125395,9 +122667,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -125409,7 +122679,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -125441,8 +122711,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -125477,11 +122746,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -125491,10 +122757,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -125507,17 +122770,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -125537,8 +122800,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -125564,23 +122826,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -125646,7 +122906,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -125669,7 +122929,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -125720,7 +122980,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -125735,7 +122995,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -125750,7 +123010,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -125781,7 +123041,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -125815,12 +123075,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -125832,9 +123088,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -125866,7 +123121,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -125915,14 +123170,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -125944,7 +123196,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -125970,17 +123222,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -125996,13 +123245,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -126065,7 +123314,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -126085,7 +123334,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -126096,7 +123345,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -126143,7 +123392,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -126163,7 +123412,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -126206,7 +123455,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -126215,7 +123464,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -126233,27 +123482,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -126312,9 +123564,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -126326,7 +123576,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -126358,8 +123608,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -126394,11 +123643,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -126408,10 +123654,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -126424,17 +123667,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -126454,8 +123697,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -126481,23 +123723,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -126563,7 +123803,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -126586,7 +123826,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -126637,7 +123877,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -126652,7 +123892,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -126667,7 +123907,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -126698,7 +123938,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -126732,12 +123972,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -126749,9 +123985,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -126783,7 +124018,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -126832,14 +124067,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -126861,7 +124093,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -126887,17 +124119,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -126913,13 +124142,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -126982,7 +124211,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -127002,7 +124231,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -127013,7 +124242,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -127060,7 +124289,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -127080,7 +124309,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -127123,7 +124352,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -127132,7 +124361,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -127150,27 +124379,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -127229,9 +124461,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -127243,7 +124473,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -127275,8 +124505,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -127311,11 +124540,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -127325,10 +124551,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -127341,17 +124564,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -127371,8 +124594,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -127398,23 +124620,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -127480,7 +124700,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -127503,7 +124723,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -127554,7 +124774,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -127569,7 +124789,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -127584,7 +124804,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -127615,7 +124835,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -127649,12 +124869,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -127666,9 +124882,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -127700,7 +124915,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -127749,14 +124964,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -127778,7 +124990,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -127804,17 +125016,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -127830,13 +125039,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -127899,7 +125108,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -127919,7 +125128,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -127930,7 +125139,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -127977,7 +125186,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -127997,7 +125206,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -128040,7 +125249,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -128049,7 +125258,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -128067,27 +125276,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -128146,9 +125358,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -128160,7 +125370,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -128192,8 +125402,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -128228,11 +125437,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -128242,10 +125448,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -128258,17 +125461,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -128288,8 +125491,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -128315,23 +125517,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -128397,7 +125597,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -128420,7 +125620,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -128471,7 +125671,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -128486,7 +125686,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -128501,7 +125701,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -128532,7 +125732,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -128566,12 +125766,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -128583,9 +125779,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -128617,7 +125812,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -128666,14 +125861,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -128695,7 +125887,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -128721,17 +125913,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -128747,13 +125936,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -128816,7 +126005,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -128836,7 +126025,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -128847,7 +126036,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -128894,7 +126083,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -128914,7 +126103,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -128957,7 +126146,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -128966,7 +126155,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -128984,27 +126173,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -129063,9 +126255,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -129077,7 +126267,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -129109,8 +126299,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -129145,11 +126334,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -129159,10 +126345,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -129175,17 +126358,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -129205,8 +126388,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -129232,23 +126414,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -129314,7 +126494,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -129337,7 +126517,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -129388,7 +126568,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -129403,7 +126583,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -129418,7 +126598,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -129449,7 +126629,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -129483,12 +126663,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -129500,9 +126676,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -129534,7 +126709,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -129583,14 +126758,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -129612,7 +126784,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -129638,17 +126810,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -129664,13 +126833,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -129733,7 +126902,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -129753,7 +126922,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -129764,7 +126933,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -129811,7 +126980,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -129831,7 +127000,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -129874,7 +127043,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -129883,7 +127052,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -129901,27 +127070,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -129980,9 +127152,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -129994,7 +127164,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -130026,8 +127196,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -130062,11 +127231,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -130076,10 +127242,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -130092,17 +127255,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -130122,8 +127285,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -130149,23 +127311,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -130231,7 +127391,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -130254,7 +127414,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -130305,7 +127465,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -130320,7 +127480,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -130335,7 +127495,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -130366,7 +127526,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -130400,12 +127560,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -130417,9 +127573,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -130451,7 +127606,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -130500,14 +127655,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -130529,7 +127681,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -130555,17 +127707,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -130581,13 +127730,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -130650,7 +127799,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -130670,7 +127819,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -130681,7 +127830,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -130728,7 +127877,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -130748,7 +127897,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -130791,7 +127940,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -130800,7 +127949,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -130818,27 +127967,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -130897,9 +128049,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -130911,7 +128061,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -130943,8 +128093,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -130979,11 +128128,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -130993,10 +128139,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -131009,17 +128152,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -131039,8 +128182,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -131066,23 +128208,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -131148,7 +128288,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -131171,7 +128311,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -131222,7 +128362,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -131237,7 +128377,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -131252,7 +128392,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -131283,7 +128423,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -131317,12 +128457,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -131334,9 +128470,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -131368,7 +128503,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -131417,14 +128552,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -131446,7 +128578,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -131472,17 +128604,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -131498,13 +128627,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -131567,7 +128696,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -131587,7 +128716,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -131598,7 +128727,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -131645,7 +128774,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -131665,7 +128794,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -131708,7 +128837,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -131717,7 +128846,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -131735,27 +128864,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -131814,9 +128946,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -131828,7 +128958,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -131860,8 +128990,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -131896,11 +129025,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -131910,10 +129036,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -131926,17 +129049,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -131956,8 +129079,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -131983,23 +129105,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -132065,7 +129185,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -132088,7 +129208,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -132139,7 +129259,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -132154,7 +129274,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -132169,7 +129289,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -132200,7 +129320,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -132234,12 +129354,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -132251,9 +129367,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -132285,7 +129400,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -132334,14 +129449,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -132363,7 +129475,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -132389,17 +129501,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -132415,13 +129524,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -132484,7 +129593,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -132504,7 +129613,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -132515,7 +129624,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -132562,7 +129671,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -132582,7 +129691,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -132625,7 +129734,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -132634,7 +129743,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -132652,27 +129761,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -132731,9 +129843,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -132745,7 +129855,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -132777,8 +129887,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -132813,11 +129922,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -132827,10 +129933,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -132843,17 +129946,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -132873,8 +129976,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -132900,23 +130002,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -132982,7 +130082,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -133005,7 +130105,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -133056,7 +130156,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -133071,7 +130171,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -133086,7 +130186,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -133117,7 +130217,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -133151,12 +130251,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -133168,9 +130264,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -133202,7 +130297,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -133251,14 +130346,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -133280,7 +130372,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -133306,17 +130398,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -133332,13 +130421,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -133401,7 +130490,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -133421,7 +130510,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -133432,7 +130521,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -133479,7 +130568,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -133499,7 +130588,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -133542,7 +130631,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -133551,7 +130640,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -133569,27 +130658,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -133648,9 +130740,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -133662,7 +130752,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -133694,8 +130784,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -133730,11 +130819,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -133744,10 +130830,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -133760,17 +130843,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -133790,8 +130873,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -133817,23 +130899,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -133899,7 +130979,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -133922,7 +131002,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -133973,7 +131053,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -133988,7 +131068,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -134003,7 +131083,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -134034,7 +131114,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -134068,12 +131148,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -134085,9 +131161,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -134119,7 +131194,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -134168,14 +131243,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -134197,7 +131269,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -134223,17 +131295,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -134249,13 +131318,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -134318,7 +131387,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -134338,7 +131407,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -134349,7 +131418,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -134396,7 +131465,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -134416,7 +131485,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -134459,7 +131528,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -134468,7 +131537,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -134486,27 +131555,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -134565,9 +131637,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -134579,7 +131649,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -134611,8 +131681,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -134647,11 +131716,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -134661,10 +131727,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -134677,17 +131740,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -134707,8 +131770,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -134734,23 +131796,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -134816,7 +131876,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -134839,7 +131899,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -134890,7 +131950,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -134905,7 +131965,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -134920,7 +131980,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -134951,7 +132011,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -134985,12 +132045,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -135002,9 +132058,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -135036,7 +132091,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -135085,14 +132140,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -135114,7 +132166,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -135140,17 +132192,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -135166,13 +132215,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -135235,7 +132284,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -135255,7 +132304,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -135266,7 +132315,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -135313,7 +132362,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -135333,7 +132382,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -135376,7 +132425,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -135385,7 +132434,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -135403,27 +132452,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -135482,9 +132534,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -135496,7 +132546,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -135528,8 +132578,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -135564,11 +132613,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -135578,10 +132624,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -135594,17 +132637,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -135624,8 +132667,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -135651,23 +132693,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -135733,7 +132773,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -135756,7 +132796,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -135807,7 +132847,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -135822,7 +132862,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -135837,7 +132877,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -135868,7 +132908,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -135902,12 +132942,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -135919,9 +132955,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -135953,7 +132988,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -136002,14 +133037,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -136031,7 +133063,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -136057,17 +133089,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -136083,13 +133112,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -136152,7 +133181,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -136172,7 +133201,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -136183,7 +133212,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -136230,7 +133259,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -136250,7 +133279,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -136293,7 +133322,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -136302,7 +133331,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -136320,27 +133349,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -136399,9 +133431,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -136413,7 +133443,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -136445,8 +133475,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -136481,11 +133510,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -136495,10 +133521,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -136511,17 +133534,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -136541,8 +133564,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -136568,23 +133590,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -136650,7 +133670,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -136673,7 +133693,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -136724,7 +133744,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -136739,7 +133759,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -136754,7 +133774,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -136785,7 +133805,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -136819,12 +133839,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -136836,9 +133852,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -136870,7 +133885,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -136919,14 +133934,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -136948,7 +133960,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -136974,17 +133986,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -137000,13 +134009,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -137069,7 +134078,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -137089,7 +134098,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -137100,7 +134109,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -137147,7 +134156,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -137167,7 +134176,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -137210,7 +134219,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -137219,7 +134228,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -137237,27 +134246,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -137316,9 +134328,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -137330,7 +134340,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -137362,8 +134372,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -137398,11 +134407,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -137412,10 +134418,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -137428,17 +134431,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -137458,8 +134461,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -137485,23 +134487,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -137567,7 +134567,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -137590,7 +134590,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -137641,7 +134641,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -137656,7 +134656,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -137671,7 +134671,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -137702,7 +134702,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -137736,12 +134736,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -137753,9 +134749,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -137787,7 +134782,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -137836,14 +134831,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -137865,7 +134857,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -137891,17 +134883,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -137917,13 +134906,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -137986,7 +134975,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -138006,7 +134995,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -138017,7 +135006,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -138064,7 +135053,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -138084,7 +135073,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -138127,7 +135116,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -138136,7 +135125,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -138154,27 +135143,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -138233,9 +135225,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -138247,7 +135237,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -138279,8 +135269,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -138315,11 +135304,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -138329,10 +135315,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -138345,17 +135328,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -138375,8 +135358,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -138402,23 +135384,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -138484,7 +135464,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -138507,7 +135487,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -138558,7 +135538,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -138573,7 +135553,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -138588,7 +135568,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -138619,7 +135599,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -138653,12 +135633,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -138670,9 +135646,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -138704,7 +135679,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -138753,14 +135728,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -138782,7 +135754,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -138808,17 +135780,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -138834,13 +135803,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -138903,7 +135872,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -138923,7 +135892,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -138934,7 +135903,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -138981,7 +135950,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -139001,7 +135970,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -139044,7 +136013,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -139053,7 +136022,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -139071,27 +136040,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -139150,9 +136122,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -139164,7 +136134,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -139196,8 +136166,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -139232,11 +136201,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -139246,10 +136212,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -139262,17 +136225,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -139292,8 +136255,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -139319,23 +136281,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -139401,7 +136361,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -139424,7 +136384,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -139475,7 +136435,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -139490,7 +136450,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -139505,7 +136465,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -139536,7 +136496,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -139570,12 +136530,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -139587,9 +136543,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -139621,7 +136576,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -139670,14 +136625,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -139699,7 +136651,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -139725,17 +136677,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -139751,13 +136700,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -139820,7 +136769,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -139840,7 +136789,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -139851,7 +136800,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -139898,7 +136847,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -139918,7 +136867,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -139961,7 +136910,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -139970,7 +136919,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -139988,27 +136937,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -140067,9 +137019,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -140081,7 +137031,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -140113,8 +137063,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -140149,11 +137098,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -140163,10 +137109,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -140179,17 +137122,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -140209,8 +137152,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -140236,23 +137178,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -140318,7 +137258,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -140341,7 +137281,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -140392,7 +137332,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -140407,7 +137347,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -140422,7 +137362,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -140453,7 +137393,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -140487,12 +137427,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -140504,9 +137440,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -140538,7 +137473,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -140587,14 +137522,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -140616,7 +137548,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -140642,17 +137574,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -140668,13 +137597,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -140737,7 +137666,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -140757,7 +137686,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -140768,7 +137697,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -140815,7 +137744,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -140835,7 +137764,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -140878,7 +137807,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -140887,7 +137816,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -140905,27 +137834,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -140984,9 +137916,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -140998,7 +137928,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -141030,8 +137960,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -141066,11 +137995,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -141080,10 +138006,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -141096,17 +138019,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -141126,8 +138049,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -141153,23 +138075,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -141235,7 +138155,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -141258,7 +138178,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -141309,7 +138229,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -141324,7 +138244,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -141339,7 +138259,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -141370,7 +138290,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -141404,12 +138324,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -141421,9 +138337,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -141455,7 +138370,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -141504,14 +138419,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -141533,7 +138445,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -141559,17 +138471,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -141585,13 +138494,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -141654,7 +138563,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -141674,7 +138583,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -141685,7 +138594,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -141732,7 +138641,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -141752,7 +138661,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -141795,7 +138704,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -141804,7 +138713,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -141822,27 +138731,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -141901,9 +138813,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -141915,7 +138825,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -141947,8 +138857,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -141983,11 +138892,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -141997,10 +138903,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -142013,17 +138916,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -142043,8 +138946,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -142070,23 +138972,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -142152,7 +139052,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -142175,7 +139075,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -142226,7 +139126,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -142241,7 +139141,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -142256,7 +139156,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -142287,7 +139187,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -142321,12 +139221,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -142338,9 +139234,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -142372,7 +139267,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -142421,14 +139316,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -142450,7 +139342,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -142476,17 +139368,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -142502,13 +139391,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -142571,7 +139460,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -142591,7 +139480,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -142602,7 +139491,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -142649,7 +139538,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -142669,7 +139558,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -142712,7 +139601,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -142721,7 +139610,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -142739,27 +139628,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -142818,9 +139710,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -142832,7 +139722,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -142864,8 +139754,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -142900,11 +139789,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -142914,10 +139800,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -142930,17 +139813,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -142960,8 +139843,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -142987,23 +139869,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -143069,7 +139949,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -143092,7 +139972,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -143143,7 +140023,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -143158,7 +140038,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -143173,7 +140053,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -143204,7 +140084,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -143238,12 +140118,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -143255,9 +140131,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -143289,7 +140164,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -143338,14 +140213,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -143367,7 +140239,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -143393,17 +140265,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -143419,13 +140288,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -143488,7 +140357,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -143508,7 +140377,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -143519,7 +140388,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -143566,7 +140435,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -143586,7 +140455,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -143629,7 +140498,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -143638,7 +140507,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -143656,27 +140525,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -143735,9 +140607,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -143749,7 +140619,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -143781,8 +140651,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -143817,11 +140686,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -143831,10 +140697,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -143847,17 +140710,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -143877,8 +140740,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -143904,23 +140766,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -143986,7 +140846,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -144009,7 +140869,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -144060,7 +140920,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -144075,7 +140935,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -144090,7 +140950,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -144121,7 +140981,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -144155,12 +141015,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -144172,9 +141028,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -144206,7 +141061,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -144255,14 +141110,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -144284,7 +141136,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -144310,17 +141162,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -144336,13 +141185,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -144405,7 +141254,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -144425,7 +141274,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -144436,7 +141285,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -144483,7 +141332,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -144503,7 +141352,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -144546,7 +141395,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -144555,7 +141404,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -144573,27 +141422,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -144652,9 +141504,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -144666,7 +141516,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -144698,8 +141548,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -144734,11 +141583,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -144748,10 +141594,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -144764,17 +141607,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -144794,8 +141637,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -144821,23 +141663,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -144903,7 +141743,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -144926,7 +141766,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -144977,7 +141817,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -144992,7 +141832,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -145007,7 +141847,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -145038,7 +141878,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -145072,12 +141912,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -145089,9 +141925,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -145123,7 +141958,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -145172,14 +142007,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -145201,7 +142033,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -145227,17 +142059,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -145253,13 +142082,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -145322,7 +142151,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -145342,7 +142171,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -145353,7 +142182,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -145400,7 +142229,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -145420,7 +142249,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -145463,7 +142292,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -145472,7 +142301,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -145490,27 +142319,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -145569,9 +142401,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -145583,7 +142413,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -145615,8 +142445,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -145651,11 +142480,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -145665,10 +142491,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -145681,17 +142504,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -145711,8 +142534,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -145738,23 +142560,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -145820,7 +142640,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -145843,7 +142663,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -145894,7 +142714,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -145909,7 +142729,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -145924,7 +142744,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -145955,7 +142775,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -145989,12 +142809,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -146006,9 +142822,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -146040,7 +142855,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -146089,14 +142904,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -146118,7 +142930,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -146144,17 +142956,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -146170,13 +142979,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -146239,7 +143048,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -146259,7 +143068,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -146270,7 +143079,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -146317,7 +143126,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -146337,7 +143146,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -146380,7 +143189,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -146389,7 +143198,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -146407,27 +143216,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -146486,9 +143298,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -146500,7 +143310,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -146532,8 +143342,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -146568,11 +143377,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -146582,10 +143388,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -146598,17 +143401,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -146628,8 +143431,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -146655,23 +143457,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -146737,7 +143537,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -146760,7 +143560,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -146811,7 +143611,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -146826,7 +143626,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -146841,7 +143641,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -146872,7 +143672,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -146906,12 +143706,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -146923,9 +143719,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -146957,7 +143752,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -147006,14 +143801,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -147035,7 +143827,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -147061,17 +143853,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -147087,13 +143876,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -147156,7 +143945,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -147176,7 +143965,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -147187,7 +143976,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -147234,7 +144023,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -147254,7 +144043,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -147297,7 +144086,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -147306,7 +144095,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -147324,27 +144113,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -147403,9 +144195,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -147417,7 +144207,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -147449,8 +144239,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -147485,11 +144274,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -147499,10 +144285,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -147515,17 +144298,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -147545,8 +144328,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -147572,23 +144354,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -147654,7 +144434,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -147677,7 +144457,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -147728,7 +144508,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -147743,7 +144523,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -147758,7 +144538,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -147789,7 +144569,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -147823,12 +144603,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -147840,9 +144616,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -147874,7 +144649,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -147923,14 +144698,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -147952,7 +144724,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -147978,17 +144750,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -148004,13 +144773,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -148073,7 +144842,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -148093,7 +144862,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -148104,7 +144873,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -148151,7 +144920,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -148171,7 +144940,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -148214,7 +144983,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -148223,7 +144992,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -148241,27 +145010,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -148320,9 +145092,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -148334,7 +145104,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -148366,8 +145136,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -148402,11 +145171,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -148416,10 +145182,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -148432,17 +145195,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -148462,8 +145225,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -148489,23 +145251,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -148571,7 +145331,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -148594,7 +145354,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -148645,7 +145405,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -148660,7 +145420,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -148675,7 +145435,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -148706,7 +145466,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -148740,12 +145500,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -148757,9 +145513,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -148791,7 +145546,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -148840,14 +145595,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -148869,7 +145621,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -148895,17 +145647,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -148921,13 +145670,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -148990,7 +145739,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -149010,7 +145759,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -149021,7 +145770,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -149068,7 +145817,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -149088,7 +145837,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -149131,7 +145880,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -149140,7 +145889,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -149158,27 +145907,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -149237,9 +145989,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -149251,7 +146001,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -149283,8 +146033,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -149319,11 +146068,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -149333,10 +146079,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -149349,17 +146092,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -149379,8 +146122,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -149406,23 +146148,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -149488,7 +146228,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -149511,7 +146251,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -149562,7 +146302,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -149577,7 +146317,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -149592,7 +146332,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -149623,7 +146363,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -149657,12 +146397,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -149674,9 +146410,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -149708,7 +146443,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -149757,14 +146492,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -149786,7 +146518,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -149812,17 +146544,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -149838,13 +146567,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -149907,7 +146636,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -149927,7 +146656,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -149938,7 +146667,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -149985,7 +146714,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -150005,7 +146734,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -150048,7 +146777,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -150057,7 +146786,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -150075,27 +146804,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -150154,9 +146886,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -150168,7 +146898,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -150200,8 +146930,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -150236,11 +146965,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -150250,10 +146976,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -150266,17 +146989,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -150296,8 +147019,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -150323,23 +147045,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -150405,7 +147125,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -150428,7 +147148,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -150479,7 +147199,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -150494,7 +147214,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -150509,7 +147229,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -150540,7 +147260,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -150574,12 +147294,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -150591,9 +147307,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -150625,7 +147340,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -150674,14 +147389,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -150703,7 +147415,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -150729,17 +147441,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -150755,13 +147464,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -150824,7 +147533,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -150844,7 +147553,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -150855,7 +147564,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -150902,7 +147611,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -150922,7 +147631,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -150965,7 +147674,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -150974,7 +147683,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -150992,27 +147701,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -151071,9 +147783,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -151085,7 +147795,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -151117,8 +147827,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -151153,11 +147862,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -151167,10 +147873,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -151183,17 +147886,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -151213,8 +147916,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -151240,23 +147942,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -151322,7 +148022,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -151345,7 +148045,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -151396,7 +148096,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -151411,7 +148111,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -151426,7 +148126,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -151457,7 +148157,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -151491,12 +148191,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -151508,9 +148204,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -151542,7 +148237,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -151591,14 +148286,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -151620,7 +148312,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -151646,17 +148338,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -151672,13 +148361,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -151741,7 +148430,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -151761,7 +148450,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -151772,7 +148461,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -151819,7 +148508,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -151839,7 +148528,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -151882,7 +148571,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -151891,7 +148580,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -151909,27 +148598,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -151988,9 +148680,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -152002,7 +148692,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -152034,8 +148724,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -152070,11 +148759,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -152084,10 +148770,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -152100,17 +148783,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -152130,8 +148813,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -152157,23 +148839,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -152239,7 +148919,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -152262,7 +148942,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -152313,7 +148993,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -152328,7 +149008,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -152343,7 +149023,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -152374,7 +149054,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -152408,12 +149088,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -152425,9 +149101,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -152459,7 +149134,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -152508,14 +149183,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -152537,7 +149209,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -152563,17 +149235,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -152589,13 +149258,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -152658,7 +149327,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -152678,7 +149347,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -152689,7 +149358,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -152736,7 +149405,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -152756,7 +149425,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -152799,7 +149468,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -152808,7 +149477,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -152826,27 +149495,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -152905,9 +149577,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -152919,7 +149589,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -152951,8 +149621,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -152987,11 +149656,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -153001,10 +149667,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -153017,17 +149680,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -153047,8 +149710,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -153074,23 +149736,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -153156,7 +149816,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -153179,7 +149839,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -153230,7 +149890,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -153245,7 +149905,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -153260,7 +149920,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -153291,7 +149951,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -153325,12 +149985,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -153342,9 +149998,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -153376,7 +150031,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -153425,14 +150080,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -153454,7 +150106,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -153480,17 +150132,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -153506,13 +150155,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -153575,7 +150224,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -153595,7 +150244,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -153606,7 +150255,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -153653,7 +150302,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -153673,7 +150322,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -153716,7 +150365,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -153725,7 +150374,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -153743,27 +150392,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -153822,9 +150474,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -153836,7 +150486,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -153868,8 +150518,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -153904,11 +150553,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -153918,10 +150564,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -153934,17 +150577,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -153964,8 +150607,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -153991,23 +150633,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -154073,7 +150713,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -154096,7 +150736,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -154147,7 +150787,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -154162,7 +150802,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -154177,7 +150817,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -154208,7 +150848,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -154242,12 +150882,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -154259,9 +150895,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -154293,7 +150928,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -154342,14 +150977,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -154371,7 +151003,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -154397,17 +151029,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -154423,13 +151052,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -154492,7 +151121,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -154512,7 +151141,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -154523,7 +151152,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -154570,7 +151199,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -154590,7 +151219,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -154633,7 +151262,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -154642,7 +151271,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -154660,27 +151289,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -154739,9 +151371,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -154753,7 +151383,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -154785,8 +151415,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -154821,11 +151450,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -154835,10 +151461,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -154851,17 +151474,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -154881,8 +151504,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -154908,23 +151530,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -154990,7 +151610,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -155013,7 +151633,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -155064,7 +151684,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -155079,7 +151699,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -155094,7 +151714,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -155125,7 +151745,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -155159,12 +151779,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -155176,9 +151792,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -155210,7 +151825,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -155259,14 +151874,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -155288,7 +151900,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -155314,17 +151926,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -155340,13 +151949,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -155409,7 +152018,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -155429,7 +152038,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -155440,7 +152049,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -155487,7 +152096,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -155507,7 +152116,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -155550,7 +152159,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -155559,7 +152168,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -155577,27 +152186,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -155656,9 +152268,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -155670,7 +152280,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -155702,8 +152312,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -155738,11 +152347,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -155752,10 +152358,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -155768,17 +152371,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -155798,8 +152401,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -155825,23 +152427,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -155907,7 +152507,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -155930,7 +152530,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -155981,7 +152581,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -155996,7 +152596,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -156011,7 +152611,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -156042,7 +152642,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -156076,12 +152676,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -156093,9 +152689,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -156127,7 +152722,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -156176,14 +152771,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -156205,7 +152797,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -156231,17 +152823,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -156257,13 +152846,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -156326,7 +152915,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -156346,7 +152935,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -156357,7 +152946,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -156404,7 +152993,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -156424,7 +153013,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -156467,7 +153056,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -156476,7 +153065,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -156494,27 +153083,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -156573,9 +153165,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -156587,7 +153177,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -156619,8 +153209,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -156655,11 +153244,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -156669,10 +153255,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -156685,17 +153268,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -156715,8 +153298,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -156742,23 +153324,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -156824,7 +153404,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -156847,7 +153427,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -156898,7 +153478,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -156913,7 +153493,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -156928,7 +153508,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -156959,7 +153539,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -156993,12 +153573,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -157010,9 +153586,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -157044,7 +153619,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -157093,14 +153668,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -157122,7 +153694,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -157148,17 +153720,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -157174,13 +153743,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -157243,7 +153812,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -157263,7 +153832,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -157274,7 +153843,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -157321,7 +153890,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -157341,7 +153910,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -157384,7 +153953,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -157393,7 +153962,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -157411,27 +153980,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -157490,9 +154062,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -157504,7 +154074,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -157536,8 +154106,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -157572,11 +154141,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -157586,10 +154152,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -157602,17 +154165,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -157632,8 +154195,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -157659,23 +154221,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -157741,7 +154301,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -157764,7 +154324,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -157815,7 +154375,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -157830,7 +154390,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -157845,7 +154405,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -157876,7 +154436,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -157910,12 +154470,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -157927,9 +154483,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -157961,7 +154516,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -158010,14 +154565,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -158039,7 +154591,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -158065,17 +154617,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -158091,13 +154640,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -158160,7 +154709,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -158180,7 +154729,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -158191,7 +154740,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -158238,7 +154787,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -158258,7 +154807,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -158301,7 +154850,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -158310,7 +154859,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -158328,27 +154877,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -158407,9 +154959,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -158421,7 +154971,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -158453,8 +155003,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -158489,11 +155038,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -158503,10 +155049,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -158519,17 +155062,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -158549,8 +155092,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -158576,23 +155118,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -158658,7 +155198,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -158681,7 +155221,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -158732,7 +155272,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -158747,7 +155287,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -158762,7 +155302,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -158793,7 +155333,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -158827,12 +155367,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -158844,9 +155380,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -158878,7 +155413,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -158927,14 +155462,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -158956,7 +155488,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -158982,17 +155514,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -159008,13 +155537,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -159077,7 +155606,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -159097,7 +155626,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -159108,7 +155637,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -159155,7 +155684,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -159175,7 +155704,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -159218,7 +155747,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -159227,7 +155756,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -159245,27 +155774,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -159324,9 +155856,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -159338,7 +155868,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -159370,8 +155900,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -159406,11 +155935,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -159420,10 +155946,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -159436,17 +155959,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -159466,8 +155989,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -159493,23 +156015,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -159575,7 +156095,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -159598,7 +156118,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -159649,7 +156169,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -159664,7 +156184,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -159679,7 +156199,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -159710,7 +156230,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -159744,12 +156264,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -159761,9 +156277,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -159795,7 +156310,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -159844,14 +156359,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -159873,7 +156385,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -159899,17 +156411,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -159925,13 +156434,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -159994,7 +156503,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -160014,7 +156523,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -160025,7 +156534,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -160072,7 +156581,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -160092,7 +156601,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -160135,7 +156644,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -160144,7 +156653,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -160162,27 +156671,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -160241,9 +156753,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -160255,7 +156765,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -160287,8 +156797,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -160323,11 +156832,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -160337,10 +156843,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -160353,17 +156856,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -160383,8 +156886,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -160410,23 +156912,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -160492,7 +156992,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -160515,7 +157015,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -160566,7 +157066,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -160581,7 +157081,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -160596,7 +157096,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -160627,7 +157127,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -160661,12 +157161,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -160678,9 +157174,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -160712,7 +157207,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -160761,14 +157256,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -160790,7 +157282,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -160816,17 +157308,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -160842,13 +157331,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -160911,7 +157400,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -160931,7 +157420,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -160942,7 +157431,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -160989,7 +157478,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -161009,7 +157498,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -161052,7 +157541,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -161061,7 +157550,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -161079,27 +157568,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -161158,9 +157650,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -161172,7 +157662,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -161204,8 +157694,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -161240,11 +157729,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -161254,10 +157740,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -161270,17 +157753,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -161300,8 +157783,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -161327,23 +157809,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -161409,7 +157889,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -161432,7 +157912,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -161483,7 +157963,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -161498,7 +157978,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -161513,7 +157993,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -161544,7 +158024,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -161578,12 +158058,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -161595,9 +158071,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -161629,7 +158104,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -161678,14 +158153,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -161707,7 +158179,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -161733,17 +158205,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -161759,13 +158228,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -161828,7 +158297,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -161848,7 +158317,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -161859,7 +158328,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -161906,7 +158375,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -161926,7 +158395,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -161969,7 +158438,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -161978,7 +158447,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -161996,27 +158465,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -162075,9 +158547,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -162089,7 +158559,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -162121,8 +158591,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -162157,11 +158626,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -162171,10 +158637,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -162187,17 +158650,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -162217,8 +158680,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -162244,23 +158706,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -162326,7 +158786,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -162349,7 +158809,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -162400,7 +158860,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -162415,7 +158875,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -162430,7 +158890,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -162461,7 +158921,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -162495,12 +158955,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -162512,9 +158968,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -162546,7 +159001,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -162595,14 +159050,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -162624,7 +159076,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -162650,17 +159102,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -162676,13 +159125,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -162745,7 +159194,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -162765,7 +159214,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -162776,7 +159225,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -162823,7 +159272,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -162843,7 +159292,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -162886,7 +159335,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -162895,7 +159344,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -162913,27 +159362,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -162992,9 +159444,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -163006,7 +159456,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -163038,8 +159488,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -163074,11 +159523,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -163088,10 +159534,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -163104,17 +159547,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -163134,8 +159577,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -163161,23 +159603,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -163243,7 +159683,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -163266,7 +159706,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -163317,7 +159757,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -163332,7 +159772,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -163347,7 +159787,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -163378,7 +159818,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -163412,12 +159852,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -163429,9 +159865,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -163463,7 +159898,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -163512,14 +159947,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -163541,7 +159973,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -163567,17 +159999,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -163593,13 +160022,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -163662,7 +160091,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -163682,7 +160111,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -163693,7 +160122,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -163740,7 +160169,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -163760,7 +160189,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -163803,7 +160232,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -163812,7 +160241,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -163830,27 +160259,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -163909,9 +160341,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -163923,7 +160353,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -163955,8 +160385,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -163991,11 +160420,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -164005,10 +160431,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -164021,17 +160444,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -164051,8 +160474,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -164078,23 +160500,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -164160,7 +160580,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -164183,7 +160603,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -164234,7 +160654,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -164249,7 +160669,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -164264,7 +160684,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -164295,7 +160715,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -164329,12 +160749,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -164346,9 +160762,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -164380,7 +160795,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -164429,14 +160844,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -164458,7 +160870,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -164484,17 +160896,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -164510,13 +160919,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -164579,7 +160988,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -164599,7 +161008,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -164610,7 +161019,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -164657,7 +161066,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -164677,7 +161086,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -164720,7 +161129,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -164729,7 +161138,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -164747,27 +161156,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -164826,9 +161238,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -164840,7 +161250,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -164872,8 +161282,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -164908,11 +161317,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -164922,10 +161328,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -164938,17 +161341,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -164968,8 +161371,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -164995,23 +161397,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -165077,7 +161477,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -165100,7 +161500,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -165151,7 +161551,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -165166,7 +161566,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -165181,7 +161581,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -165212,7 +161612,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -165246,12 +161646,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -165263,9 +161659,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -165297,7 +161692,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -165346,14 +161741,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -165375,7 +161767,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -165401,17 +161793,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -165427,13 +161816,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -165496,7 +161885,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -165516,7 +161905,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -165527,7 +161916,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -165574,7 +161963,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -165594,7 +161983,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -165637,7 +162026,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -165646,7 +162035,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -165664,27 +162053,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -165743,9 +162135,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -165757,7 +162147,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -165789,8 +162179,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -165825,11 +162214,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -165839,10 +162225,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -165855,17 +162238,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -165885,8 +162268,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -165912,23 +162294,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -165994,7 +162374,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -166017,7 +162397,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -166068,7 +162448,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -166083,7 +162463,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -166098,7 +162478,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -166129,7 +162509,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -166163,12 +162543,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -166180,9 +162556,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -166214,7 +162589,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -166263,14 +162638,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -166292,7 +162664,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -166318,17 +162690,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -166344,13 +162713,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -166413,7 +162782,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -166433,7 +162802,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -166444,7 +162813,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -166491,7 +162860,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -166511,7 +162880,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -166554,7 +162923,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -166563,7 +162932,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -166581,27 +162950,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -166660,9 +163032,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -166674,7 +163044,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -166706,8 +163076,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -166742,11 +163111,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -166756,10 +163122,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -166772,17 +163135,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -166802,8 +163165,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -166829,23 +163191,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -166911,7 +163271,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -166934,7 +163294,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -166985,7 +163345,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -167000,7 +163360,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -167015,7 +163375,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -167046,7 +163406,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -167080,12 +163440,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -167097,9 +163453,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -167131,7 +163486,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -167180,14 +163535,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -167209,7 +163561,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -167235,17 +163587,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -167261,13 +163610,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -167330,7 +163679,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -167350,7 +163699,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -167361,7 +163710,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -167408,7 +163757,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -167428,7 +163777,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -167471,7 +163820,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -167480,7 +163829,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -167498,27 +163847,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -167577,9 +163929,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -167591,7 +163941,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -167623,8 +163973,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -167659,11 +164008,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -167673,10 +164019,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -167689,17 +164032,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -167719,8 +164062,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -167746,23 +164088,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -167828,7 +164168,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -167851,7 +164191,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -167902,7 +164242,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -167917,7 +164257,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -167932,7 +164272,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -167963,7 +164303,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -167997,12 +164337,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -168014,9 +164350,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -168048,7 +164383,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -168097,14 +164432,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -168126,7 +164458,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -168152,17 +164484,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -168178,13 +164507,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -168247,7 +164576,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -168267,7 +164596,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -168278,7 +164607,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -168325,7 +164654,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -168345,7 +164674,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -168388,7 +164717,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -168397,7 +164726,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -168415,27 +164744,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -168494,9 +164826,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -168508,7 +164838,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -168540,8 +164870,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -168576,11 +164905,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -168590,10 +164916,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -168606,17 +164929,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -168636,8 +164959,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -168663,23 +164985,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -168745,7 +165065,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -168768,7 +165088,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -168819,7 +165139,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -168834,7 +165154,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -168849,7 +165169,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -168880,7 +165200,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -168914,12 +165234,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -168931,9 +165247,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -168965,7 +165280,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -169014,14 +165329,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -169043,7 +165355,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -169069,17 +165381,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -169095,13 +165404,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -169164,7 +165473,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -169184,7 +165493,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -169195,7 +165504,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -169242,7 +165551,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -169262,7 +165571,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -169305,7 +165614,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -169314,7 +165623,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -169332,27 +165641,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -169411,9 +165723,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -169425,7 +165735,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -169457,8 +165767,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -169493,11 +165802,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -169507,10 +165813,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -169523,17 +165826,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -169553,8 +165856,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -169580,23 +165882,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -169662,7 +165962,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -169685,7 +165985,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -169736,7 +166036,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -169751,7 +166051,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -169766,7 +166066,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -169797,7 +166097,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -169831,12 +166131,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -169848,9 +166144,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -169882,7 +166177,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -169931,14 +166226,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -169960,7 +166252,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -169986,17 +166278,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -170012,13 +166301,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -170081,7 +166370,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -170101,7 +166390,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -170112,7 +166401,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -170159,7 +166448,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -170179,7 +166468,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -170222,7 +166511,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -170231,7 +166520,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -170249,27 +166538,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -170328,9 +166620,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -170342,7 +166632,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -170374,8 +166664,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -170410,11 +166699,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -170424,10 +166710,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -170440,17 +166723,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -170470,8 +166753,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -170497,23 +166779,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -170579,7 +166859,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -170602,7 +166882,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -170653,7 +166933,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -170668,7 +166948,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -170683,7 +166963,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -170714,7 +166994,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -170748,12 +167028,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -170765,9 +167041,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -170799,7 +167074,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -170848,14 +167123,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -170877,7 +167149,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -170903,17 +167175,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -170929,13 +167198,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -170998,7 +167267,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -171018,7 +167287,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -171029,7 +167298,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -171076,7 +167345,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -171096,7 +167365,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -171139,7 +167408,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -171148,7 +167417,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -171166,27 +167435,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -171245,9 +167517,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -171259,7 +167529,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -171291,8 +167561,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -171327,11 +167596,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -171341,10 +167607,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -171357,17 +167620,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -171387,8 +167650,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -171414,23 +167676,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -171496,7 +167756,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -171519,7 +167779,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -171570,7 +167830,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -171585,7 +167845,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -171600,7 +167860,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -171631,7 +167891,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -171665,12 +167925,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -171682,9 +167938,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -171716,7 +167971,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -171765,14 +168020,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -171794,7 +168046,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -171820,17 +168072,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -171846,13 +168095,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -171915,7 +168164,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -171935,7 +168184,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -171946,7 +168195,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -171993,7 +168242,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -172013,7 +168262,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -172056,7 +168305,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -172065,7 +168314,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -172083,27 +168332,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -172162,9 +168414,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -172176,7 +168426,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -172208,8 +168458,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -172244,11 +168493,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -172258,10 +168504,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -172274,17 +168517,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -172304,8 +168547,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -172331,23 +168573,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -172413,7 +168653,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -172436,7 +168676,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -172487,7 +168727,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -172502,7 +168742,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -172517,7 +168757,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -172548,7 +168788,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -172582,12 +168822,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -172599,9 +168835,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -172633,7 +168868,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -172682,14 +168917,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -172711,7 +168943,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -172737,17 +168969,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -172763,13 +168992,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -172832,7 +169061,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -172852,7 +169081,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -172863,7 +169092,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -172910,7 +169139,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -172930,7 +169159,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -172973,7 +169202,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -172982,7 +169211,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -173000,27 +169229,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -173079,9 +169311,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -173093,7 +169323,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -173125,8 +169355,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -173161,11 +169390,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -173175,10 +169401,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -173191,17 +169414,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -173221,8 +169444,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -173248,23 +169470,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -173330,7 +169550,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -173353,7 +169573,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -173404,7 +169624,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -173419,7 +169639,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -173434,7 +169654,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -173465,7 +169685,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -173499,12 +169719,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -173516,9 +169732,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -173550,7 +169765,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -173599,14 +169814,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -173628,7 +169840,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -173654,17 +169866,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -173680,13 +169889,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -173749,7 +169958,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -173769,7 +169978,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -173780,7 +169989,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -173827,7 +170036,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -173847,7 +170056,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -173890,7 +170099,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -173899,7 +170108,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -173917,27 +170126,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -173996,9 +170208,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -174010,7 +170220,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -174042,8 +170252,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -174078,11 +170287,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -174092,10 +170298,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -174108,17 +170311,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -174138,8 +170341,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -174165,23 +170367,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -174247,7 +170447,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -174270,7 +170470,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -174321,7 +170521,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -174336,7 +170536,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -174351,7 +170551,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -174382,7 +170582,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -174416,12 +170616,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -174433,9 +170629,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -174467,7 +170662,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -174516,14 +170711,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -174545,7 +170737,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -174571,17 +170763,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -174597,13 +170786,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -174666,7 +170855,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -174686,7 +170875,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -174697,7 +170886,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -174744,7 +170933,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -174764,7 +170953,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -174807,7 +170996,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -174816,7 +171005,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -174834,27 +171023,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -174913,9 +171105,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -174927,7 +171117,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -174959,8 +171149,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -174995,11 +171184,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -175009,10 +171195,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -175025,17 +171208,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -175055,8 +171238,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -175082,23 +171264,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -175164,7 +171344,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -175187,7 +171367,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -175238,7 +171418,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -175253,7 +171433,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -175268,7 +171448,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -175299,7 +171479,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -175333,12 +171513,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -175350,9 +171526,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -175384,7 +171559,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -175433,14 +171608,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -175462,7 +171634,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -175488,17 +171660,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -175514,13 +171683,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -175583,7 +171752,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -175603,7 +171772,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -175614,7 +171783,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -175661,7 +171830,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -175681,7 +171850,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -175724,7 +171893,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -175733,7 +171902,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -175751,27 +171920,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -175830,9 +172002,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -175844,7 +172014,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -175876,8 +172046,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -175912,11 +172081,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -175926,10 +172092,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -175942,17 +172105,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -175972,8 +172135,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -175999,23 +172161,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -176081,7 +172241,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -176104,7 +172264,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -176155,7 +172315,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -176170,7 +172330,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -176185,7 +172345,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -176216,7 +172376,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -176250,12 +172410,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -176267,9 +172423,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -176301,7 +172456,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -176350,14 +172505,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -176379,7 +172531,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -176405,17 +172557,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -176431,13 +172580,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -176500,7 +172649,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -176520,7 +172669,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -176531,7 +172680,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -176578,7 +172727,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -176598,7 +172747,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -176641,7 +172790,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -176650,7 +172799,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -176668,27 +172817,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -176747,9 +172899,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -176761,7 +172911,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -176793,8 +172943,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -176829,11 +172978,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -176843,10 +172989,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -176859,17 +173002,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -176889,8 +173032,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -176916,23 +173058,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -176998,7 +173138,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -177021,7 +173161,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -177072,7 +173212,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -177087,7 +173227,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -177102,7 +173242,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -177133,7 +173273,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -177167,12 +173307,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -177184,9 +173320,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -177218,7 +173353,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -177267,14 +173402,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -177296,7 +173428,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -177322,17 +173454,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -177348,13 +173477,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -177417,7 +173546,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -177437,7 +173566,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -177448,7 +173577,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -177495,7 +173624,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -177515,7 +173644,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -177558,7 +173687,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -177567,7 +173696,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -177585,27 +173714,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -177664,9 +173796,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -177678,7 +173808,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -177710,8 +173840,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -177746,11 +173875,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -177760,10 +173886,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -177776,17 +173899,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -177806,8 +173929,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -177833,23 +173955,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -177915,7 +174035,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -177938,7 +174058,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -177989,7 +174109,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -178004,7 +174124,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -178019,7 +174139,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -178050,7 +174170,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -178084,12 +174204,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -178101,9 +174217,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -178135,7 +174250,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -178184,14 +174299,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -178213,7 +174325,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -178239,17 +174351,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -178265,13 +174374,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -178334,7 +174443,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -178354,7 +174463,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -178365,7 +174474,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -178412,7 +174521,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -178432,7 +174541,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -178475,7 +174584,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -178484,7 +174593,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -178502,27 +174611,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -178581,9 +174693,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -178595,7 +174705,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -178627,8 +174737,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -178663,11 +174772,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -178677,10 +174783,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -178693,17 +174796,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -178723,8 +174826,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -178750,23 +174852,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -178832,7 +174932,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -178855,7 +174955,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -178906,7 +175006,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -178921,7 +175021,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -178936,7 +175036,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -178967,7 +175067,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -179001,12 +175101,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -179018,9 +175114,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -179052,7 +175147,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -179101,14 +175196,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -179130,7 +175222,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -179156,17 +175248,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -179182,13 +175271,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -179251,7 +175340,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -179271,7 +175360,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -179282,7 +175371,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -179329,7 +175418,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -179349,7 +175438,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -179392,7 +175481,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -179401,7 +175490,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -179419,27 +175508,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -179498,9 +175590,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -179512,7 +175602,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -179544,8 +175634,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -179580,11 +175669,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -179594,10 +175680,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -179610,17 +175693,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -179640,8 +175723,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -179667,23 +175749,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -179749,7 +175829,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -179772,7 +175852,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -179823,7 +175903,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -179838,7 +175918,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -179853,7 +175933,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -179884,7 +175964,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -179918,12 +175998,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -179935,9 +176011,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -179969,7 +176044,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -180018,14 +176093,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -180047,7 +176119,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -180073,17 +176145,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -180099,13 +176168,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -180168,7 +176237,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -180188,7 +176257,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -180199,7 +176268,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -180246,7 +176315,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -180266,7 +176335,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -180309,7 +176378,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -180318,7 +176387,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -180336,27 +176405,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -180415,9 +176487,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -180429,7 +176499,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -180461,8 +176531,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -180497,11 +176566,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -180511,10 +176577,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -180527,17 +176590,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -180557,8 +176620,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -180584,23 +176646,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -180666,7 +176726,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -180689,7 +176749,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -180740,7 +176800,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -180755,7 +176815,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -180770,7 +176830,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -180801,7 +176861,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -180835,12 +176895,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -180852,9 +176908,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -180886,7 +176941,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -180935,14 +176990,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -180964,7 +177016,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -180990,17 +177042,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -181016,13 +177065,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -181085,7 +177134,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -181105,7 +177154,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -181116,7 +177165,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -181163,7 +177212,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -181183,7 +177232,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -181226,7 +177275,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -181235,7 +177284,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -181253,27 +177302,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -181332,9 +177384,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -181346,7 +177396,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -181378,8 +177428,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -181414,11 +177463,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -181428,10 +177474,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -181444,17 +177487,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -181474,8 +177517,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -181501,23 +177543,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -181583,7 +177623,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -181606,7 +177646,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -181657,7 +177697,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -181672,7 +177712,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -181687,7 +177727,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -181718,7 +177758,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -181752,12 +177792,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -181769,9 +177805,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -181803,7 +177838,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -181852,14 +177887,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -181881,7 +177913,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -181907,17 +177939,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -181933,13 +177962,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -182002,7 +178031,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -182022,7 +178051,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -182033,7 +178062,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -182080,7 +178109,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -182100,7 +178129,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -182143,7 +178172,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -182152,7 +178181,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -182170,27 +178199,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -182249,9 +178281,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -182263,7 +178293,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -182295,8 +178325,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -182331,11 +178360,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -182345,10 +178371,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -182361,17 +178384,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -182391,8 +178414,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -182418,23 +178440,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -182500,7 +178520,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -182523,7 +178543,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -182574,7 +178594,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -182589,7 +178609,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -182604,7 +178624,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -182635,7 +178655,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -182669,12 +178689,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -182686,9 +178702,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -182720,7 +178735,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -182769,14 +178784,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -182798,7 +178810,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -182824,17 +178836,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -182850,13 +178859,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -182919,7 +178928,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -182939,7 +178948,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -182950,7 +178959,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -182997,7 +179006,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -183017,7 +179026,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -183060,7 +179069,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -183069,7 +179078,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -183087,27 +179096,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -183166,9 +179178,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -183180,7 +179190,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -183212,8 +179222,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -183248,11 +179257,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -183262,10 +179268,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -183278,17 +179281,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -183308,8 +179311,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -183335,23 +179337,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -183417,7 +179417,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -183440,7 +179440,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -183491,7 +179491,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -183506,7 +179506,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -183521,7 +179521,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -183552,7 +179552,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -183586,12 +179586,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -183603,9 +179599,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -183637,7 +179632,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -183686,14 +179681,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -183715,7 +179707,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -183741,17 +179733,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -183767,13 +179756,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -183836,7 +179825,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -183856,7 +179845,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -183867,7 +179856,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -183914,7 +179903,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -183934,7 +179923,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -183977,7 +179966,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -183986,7 +179975,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -184004,27 +179993,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -184083,9 +180075,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -184097,7 +180087,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -184129,8 +180119,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -184165,11 +180154,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -184179,10 +180165,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -184195,17 +180178,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -184225,8 +180208,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -184252,23 +180234,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -184334,7 +180314,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -184357,7 +180337,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -184408,7 +180388,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -184423,7 +180403,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -184438,7 +180418,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -184469,7 +180449,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -184503,12 +180483,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -184520,9 +180496,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -184554,7 +180529,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -184603,14 +180578,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -184632,7 +180604,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -184658,17 +180630,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -184684,13 +180653,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -184753,7 +180722,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -184773,7 +180742,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -184784,7 +180753,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -184831,7 +180800,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -184851,7 +180820,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -184894,7 +180863,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -184903,7 +180872,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -184921,27 +180890,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -185000,9 +180972,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -185014,7 +180984,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -185046,8 +181016,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -185082,11 +181051,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -185096,10 +181062,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -185112,17 +181075,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -185142,8 +181105,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -185169,23 +181131,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -185251,7 +181211,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -185274,7 +181234,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -185325,7 +181285,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -185340,7 +181300,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -185355,7 +181315,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -185386,7 +181346,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -185420,12 +181380,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -185437,9 +181393,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -185471,7 +181426,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -185520,14 +181475,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -185549,7 +181501,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -185575,17 +181527,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -185601,13 +181550,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -185670,7 +181619,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -185690,7 +181639,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -185701,7 +181650,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -185748,7 +181697,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -185768,7 +181717,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -185811,7 +181760,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -185820,7 +181769,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -185838,27 +181787,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -185917,9 +181869,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -185931,7 +181881,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -185963,8 +181913,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -185999,11 +181948,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -186013,10 +181959,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -186029,17 +181972,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -186059,8 +182002,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -186086,23 +182028,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -186168,7 +182108,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -186191,7 +182131,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -186242,7 +182182,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -186257,7 +182197,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -186272,7 +182212,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -186303,7 +182243,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -186337,12 +182277,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -186354,9 +182290,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -186388,7 +182323,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -186437,14 +182372,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -186466,7 +182398,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -186492,17 +182424,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -186518,13 +182447,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -186587,7 +182516,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -186607,7 +182536,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -186618,7 +182547,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -186665,7 +182594,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -186685,7 +182614,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -186728,7 +182657,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -186737,7 +182666,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -186755,27 +182684,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -186834,9 +182766,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -186848,7 +182778,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -186880,8 +182810,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -186916,11 +182845,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -186930,10 +182856,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -186946,17 +182869,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -186976,8 +182899,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -187003,23 +182925,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -187085,7 +183005,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -187108,7 +183028,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -187159,7 +183079,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -187174,7 +183094,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -187189,7 +183109,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -187220,7 +183140,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -187254,12 +183174,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -187271,9 +183187,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -187305,7 +183220,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -187354,14 +183269,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -187383,7 +183295,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -187409,17 +183321,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -187435,13 +183344,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -187504,7 +183413,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -187524,7 +183433,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -187535,7 +183444,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -187582,7 +183491,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -187602,7 +183511,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -187645,7 +183554,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -187654,7 +183563,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -187672,27 +183581,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -187751,9 +183663,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -187765,7 +183675,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -187797,8 +183707,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -187833,11 +183742,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -187847,10 +183753,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -187863,17 +183766,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -187893,8 +183796,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -187920,23 +183822,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -188002,7 +183902,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -188025,7 +183925,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -188076,7 +183976,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -188091,7 +183991,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -188106,7 +184006,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -188137,7 +184037,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -188171,12 +184071,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -188188,9 +184084,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -188222,7 +184117,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -188271,14 +184166,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -188300,7 +184192,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -188326,17 +184218,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -188352,13 +184241,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -188421,7 +184310,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -188441,7 +184330,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -188452,7 +184341,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -188499,7 +184388,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -188519,7 +184408,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -188562,7 +184451,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -188571,7 +184460,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -188589,27 +184478,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -188668,9 +184560,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -188682,7 +184572,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -188714,8 +184604,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -188750,11 +184639,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -188764,10 +184650,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -188780,17 +184663,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -188810,8 +184693,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -188837,23 +184719,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -188919,7 +184799,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -188942,7 +184822,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -188993,7 +184873,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -189008,7 +184888,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -189023,7 +184903,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -189054,7 +184934,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -189088,12 +184968,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -189105,9 +184981,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -189139,7 +185014,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -189188,14 +185063,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -189217,7 +185089,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -189243,17 +185115,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -189269,13 +185138,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -189338,7 +185207,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -189358,7 +185227,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -189369,7 +185238,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -189416,7 +185285,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -189436,7 +185305,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -189479,7 +185348,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -189488,7 +185357,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -189506,27 +185375,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -189585,9 +185457,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -189599,7 +185469,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -189631,8 +185501,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -189667,11 +185536,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -189681,10 +185547,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -189697,17 +185560,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -189727,8 +185590,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -189754,23 +185616,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -189836,7 +185696,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -189859,7 +185719,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -189910,7 +185770,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -189925,7 +185785,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -189940,7 +185800,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -189971,7 +185831,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -190005,12 +185865,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -190022,9 +185878,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -190056,7 +185911,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -190105,14 +185960,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -190134,7 +185986,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -190160,17 +186012,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -190186,13 +186035,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -190255,7 +186104,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -190275,7 +186124,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -190286,7 +186135,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -190333,7 +186182,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -190353,7 +186202,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -190396,7 +186245,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -190405,7 +186254,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -190423,27 +186272,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -190502,9 +186354,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -190516,7 +186366,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -190548,8 +186398,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -190584,11 +186433,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -190598,10 +186444,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -190614,17 +186457,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -190644,8 +186487,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -190671,23 +186513,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -190753,7 +186593,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -190776,7 +186616,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -190827,7 +186667,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -190842,7 +186682,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -190857,7 +186697,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -190888,7 +186728,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -190922,12 +186762,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -190939,9 +186775,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -190973,7 +186808,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -191022,14 +186857,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -191051,7 +186883,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -191077,17 +186909,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -191103,13 +186932,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -191172,7 +187001,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -191192,7 +187021,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -191203,7 +187032,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -191250,7 +187079,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -191270,7 +187099,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -191313,7 +187142,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -191322,7 +187151,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -191340,27 +187169,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -191419,9 +187251,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -191433,7 +187263,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -191465,8 +187295,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -191501,11 +187330,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -191515,10 +187341,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -191531,17 +187354,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -191561,8 +187384,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -191588,23 +187410,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -191670,7 +187490,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -191693,7 +187513,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -191744,7 +187564,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -191759,7 +187579,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -191774,7 +187594,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -191805,7 +187625,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -191839,12 +187659,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -191856,9 +187672,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -191890,7 +187705,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -191939,14 +187754,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -191968,7 +187780,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -191994,17 +187806,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -192020,13 +187829,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -192089,7 +187898,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -192109,7 +187918,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -192120,7 +187929,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -192167,7 +187976,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -192187,7 +187996,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -192230,7 +188039,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -192239,7 +188048,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -192257,27 +188066,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -192336,9 +188148,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -192350,7 +188160,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -192382,8 +188192,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -192418,11 +188227,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -192432,10 +188238,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -192448,17 +188251,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -192478,8 +188281,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -192505,23 +188307,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -192587,7 +188387,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -192610,7 +188410,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -192661,7 +188461,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -192676,7 +188476,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -192691,7 +188491,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -192722,7 +188522,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -192756,12 +188556,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -192773,9 +188569,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -192807,7 +188602,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -192856,14 +188651,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -192885,7 +188677,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -192911,17 +188703,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -192937,13 +188726,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -193006,7 +188795,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -193026,7 +188815,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -193037,7 +188826,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -193084,7 +188873,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -193104,7 +188893,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -193147,7 +188936,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -193156,7 +188945,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -193174,27 +188963,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -193253,9 +189045,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -193267,7 +189057,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -193299,8 +189089,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -193335,11 +189124,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -193349,10 +189135,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -193365,17 +189148,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -193395,8 +189178,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -193422,23 +189204,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -193504,7 +189284,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -193527,7 +189307,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -193578,7 +189358,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -193593,7 +189373,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -193608,7 +189388,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -193639,7 +189419,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -193673,12 +189453,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -193690,9 +189466,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -193724,7 +189499,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -193773,14 +189548,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -193802,7 +189574,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -193828,17 +189600,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -193854,13 +189623,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -193923,7 +189692,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -193943,7 +189712,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -193954,7 +189723,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -194001,7 +189770,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -194021,7 +189790,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -194064,7 +189833,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -194073,7 +189842,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -194091,27 +189860,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -194170,9 +189942,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -194184,7 +189954,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -194216,8 +189986,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -194252,11 +190021,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -194266,10 +190032,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -194282,17 +190045,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -194312,8 +190075,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -194339,23 +190101,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -194421,7 +190181,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -194444,7 +190204,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -194495,7 +190255,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -194510,7 +190270,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -194525,7 +190285,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -194556,7 +190316,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -194590,12 +190350,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -194607,9 +190363,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -194641,7 +190396,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -194690,14 +190445,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -194719,7 +190471,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -194745,17 +190497,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -194771,13 +190520,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -194840,7 +190589,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -194860,7 +190609,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -194871,7 +190620,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -194918,7 +190667,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -194938,7 +190687,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -194981,7 +190730,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -194990,7 +190739,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -195008,27 +190757,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -195087,9 +190839,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -195101,7 +190851,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -195133,8 +190883,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -195169,11 +190918,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -195183,10 +190929,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -195199,17 +190942,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -195229,8 +190972,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -195256,23 +190998,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -195338,7 +191078,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -195361,7 +191101,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -195412,7 +191152,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -195427,7 +191167,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -195442,7 +191182,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -195473,7 +191213,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -195507,12 +191247,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -195524,9 +191260,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -195558,7 +191293,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -195607,14 +191342,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -195636,7 +191368,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -195662,17 +191394,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -195688,13 +191417,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -195757,7 +191486,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -195777,7 +191506,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -195788,7 +191517,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -195835,7 +191564,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -195855,7 +191584,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -195898,7 +191627,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -195907,7 +191636,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -195925,27 +191654,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -196004,9 +191736,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -196018,7 +191748,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -196050,8 +191780,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -196086,11 +191815,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -196100,10 +191826,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -196116,17 +191839,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -196146,8 +191869,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -196173,23 +191895,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -196255,7 +191975,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -196278,7 +191998,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -196329,7 +192049,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -196344,7 +192064,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -196359,7 +192079,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -196390,7 +192110,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -196424,12 +192144,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -196441,9 +192157,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -196475,7 +192190,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -196524,14 +192239,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -196553,7 +192265,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -196579,17 +192291,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -196605,13 +192314,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -196674,7 +192383,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -196694,7 +192403,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -196705,7 +192414,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -196752,7 +192461,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -196772,7 +192481,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -196815,7 +192524,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -196824,7 +192533,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -196842,27 +192551,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -196921,9 +192633,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -196935,7 +192645,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -196967,8 +192677,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -197003,11 +192712,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -197017,10 +192723,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -197033,17 +192736,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -197063,8 +192766,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -197090,23 +192792,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -197172,7 +192872,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -197195,7 +192895,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -197246,7 +192946,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -197261,7 +192961,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -197276,7 +192976,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -197307,7 +193007,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -197341,12 +193041,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -197358,9 +193054,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -197392,7 +193087,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -197441,14 +193136,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -197470,7 +193162,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -197496,17 +193188,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -197522,13 +193211,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -197591,7 +193280,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -197611,7 +193300,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -197622,7 +193311,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -197669,7 +193358,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -197689,7 +193378,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -197732,7 +193421,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -197741,7 +193430,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -197759,27 +193448,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -197838,9 +193530,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -197852,7 +193542,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -197884,8 +193574,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -197920,11 +193609,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -197934,10 +193620,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -197950,17 +193633,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -197980,8 +193663,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -198007,23 +193689,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -198089,7 +193769,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -198112,7 +193792,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -198163,7 +193843,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -198178,7 +193858,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -198193,7 +193873,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -198224,7 +193904,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -198258,12 +193938,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -198275,9 +193951,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -198309,7 +193984,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -198358,14 +194033,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -198387,7 +194059,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -198413,17 +194085,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -198439,13 +194108,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -198508,7 +194177,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -198528,7 +194197,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -198539,7 +194208,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -198586,7 +194255,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -198606,7 +194275,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -198649,7 +194318,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -198658,7 +194327,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -198676,27 +194345,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -198755,9 +194427,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -198769,7 +194439,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -198801,8 +194471,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -198837,11 +194506,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -198851,10 +194517,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -198867,17 +194530,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -198897,8 +194560,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -198924,23 +194586,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -199006,7 +194666,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -199029,7 +194689,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -199080,7 +194740,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -199095,7 +194755,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -199110,7 +194770,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -199141,7 +194801,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -199175,12 +194835,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -199192,9 +194848,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -199226,7 +194881,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -199275,14 +194930,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -199304,7 +194956,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -199330,17 +194982,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -199356,13 +195005,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -199425,7 +195074,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -199445,7 +195094,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -199456,7 +195105,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -199503,7 +195152,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -199523,7 +195172,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -199566,7 +195215,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -199575,7 +195224,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -199593,27 +195242,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -199672,9 +195324,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -199686,7 +195336,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -199718,8 +195368,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -199754,11 +195403,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -199768,10 +195414,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -199784,17 +195427,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -199814,8 +195457,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -199841,23 +195483,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -199923,7 +195563,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -199946,7 +195586,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -199997,7 +195637,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -200012,7 +195652,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -200027,7 +195667,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -200058,7 +195698,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -200092,12 +195732,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -200109,9 +195745,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -200143,7 +195778,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -200192,14 +195827,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -200221,7 +195853,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -200247,17 +195879,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -200273,13 +195902,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -200342,7 +195971,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -200362,7 +195991,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -200373,7 +196002,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -200420,7 +196049,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -200440,7 +196069,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -200483,7 +196112,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -200492,7 +196121,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -200510,27 +196139,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -200589,9 +196221,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -200603,7 +196233,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -200635,8 +196265,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -200671,11 +196300,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -200685,10 +196311,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -200701,17 +196324,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -200731,8 +196354,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -200758,23 +196380,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -200840,7 +196460,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -200863,7 +196483,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -200914,7 +196534,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -200929,7 +196549,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -200944,7 +196564,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -200975,7 +196595,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -201009,12 +196629,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -201026,9 +196642,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -201060,7 +196675,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -201109,14 +196724,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -201138,7 +196750,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -201164,17 +196776,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -201190,13 +196799,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -201259,7 +196868,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -201279,7 +196888,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -201290,7 +196899,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -201337,7 +196946,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -201357,7 +196966,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -201400,7 +197009,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -201409,7 +197018,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -201427,27 +197036,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -201506,9 +197118,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -201520,7 +197130,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -201552,8 +197162,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -201588,11 +197197,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -201602,10 +197208,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -201618,17 +197221,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -201648,8 +197251,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -201675,23 +197277,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -201757,7 +197357,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -201780,7 +197380,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -201831,7 +197431,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -201846,7 +197446,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -201861,7 +197461,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -201892,7 +197492,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -201926,12 +197526,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -201943,9 +197539,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -201977,7 +197572,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -202026,14 +197621,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -202055,7 +197647,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -202081,17 +197673,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -202107,13 +197696,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -202176,7 +197765,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -202196,7 +197785,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -202207,7 +197796,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -202254,7 +197843,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -202274,7 +197863,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -202317,7 +197906,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -202326,7 +197915,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -202344,27 +197933,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -202423,9 +198015,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -202437,7 +198027,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -202469,8 +198059,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -202505,11 +198094,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -202519,10 +198105,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -202535,17 +198118,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -202565,8 +198148,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -202592,23 +198174,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -202674,7 +198254,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -202697,7 +198277,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -202748,7 +198328,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -202763,7 +198343,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -202778,7 +198358,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -202809,7 +198389,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -202843,12 +198423,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -202860,9 +198436,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -202894,7 +198469,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -202943,14 +198518,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -202972,7 +198544,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -202998,17 +198570,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -203024,13 +198593,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -203093,7 +198662,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -203113,7 +198682,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -203124,7 +198693,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -203171,7 +198740,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -203191,7 +198760,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -203234,7 +198803,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -203243,7 +198812,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -203261,27 +198830,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -203340,9 +198912,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -203354,7 +198924,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -203386,8 +198956,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -203422,11 +198991,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -203436,10 +199002,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -203452,17 +199015,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -203482,8 +199045,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -203509,23 +199071,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -203591,7 +199151,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -203614,7 +199174,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -203665,7 +199225,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -203680,7 +199240,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -203695,7 +199255,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -203726,7 +199286,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -203760,12 +199320,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -203777,9 +199333,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -203811,7 +199366,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -203860,14 +199415,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -203889,7 +199441,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -203915,17 +199467,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -203941,13 +199490,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -204010,7 +199559,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -204030,7 +199579,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -204041,7 +199590,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -204088,7 +199637,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -204108,7 +199657,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -204151,7 +199700,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -204160,7 +199709,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -204178,27 +199727,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -204257,9 +199809,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -204271,7 +199821,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -204303,8 +199853,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -204339,11 +199888,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -204353,10 +199899,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -204369,17 +199912,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -204399,8 +199942,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -204426,23 +199968,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -204508,7 +200048,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -204531,7 +200071,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -204582,7 +200122,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -204597,7 +200137,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -204612,7 +200152,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -204643,7 +200183,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -204677,12 +200217,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -204694,9 +200230,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -204728,7 +200263,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -204777,14 +200312,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -204806,7 +200338,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -204832,17 +200364,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -204858,13 +200387,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -204927,7 +200456,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -204947,7 +200476,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -204958,7 +200487,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -205005,7 +200534,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -205025,7 +200554,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -205068,7 +200597,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -205077,7 +200606,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -205095,27 +200624,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -205174,9 +200706,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -205188,7 +200718,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -205220,8 +200750,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -205256,11 +200785,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -205270,10 +200796,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -205286,17 +200809,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -205316,8 +200839,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -205343,23 +200865,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -205425,7 +200945,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -205448,7 +200968,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -205499,7 +201019,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -205514,7 +201034,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -205529,7 +201049,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -205560,7 +201080,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -205594,12 +201114,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -205611,9 +201127,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -205645,7 +201160,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -205694,14 +201209,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -205723,7 +201235,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -205749,17 +201261,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -205775,13 +201284,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -205844,7 +201353,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -205864,7 +201373,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -205875,7 +201384,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -205922,7 +201431,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -205942,7 +201451,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -205985,7 +201494,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -205994,7 +201503,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -206012,27 +201521,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -206091,9 +201603,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -206105,7 +201615,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -206137,8 +201647,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -206173,11 +201682,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -206187,10 +201693,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -206203,17 +201706,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -206233,8 +201736,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -206260,23 +201762,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -206342,7 +201842,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -206365,7 +201865,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -206416,7 +201916,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -206431,7 +201931,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -206446,7 +201946,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -206477,7 +201977,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -206511,12 +202011,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -206528,9 +202024,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -206562,7 +202057,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -206611,14 +202106,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -206640,7 +202132,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -206666,17 +202158,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -206692,13 +202181,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -206761,7 +202250,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -206781,7 +202270,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -206792,7 +202281,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -206839,7 +202328,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -206859,7 +202348,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -206902,7 +202391,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -206911,7 +202400,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -206929,27 +202418,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -207008,9 +202500,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -207022,7 +202512,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -207054,8 +202544,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -207090,11 +202579,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -207104,10 +202590,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -207120,17 +202603,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -207150,8 +202633,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -207177,23 +202659,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -207259,7 +202739,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -207282,7 +202762,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -207333,7 +202813,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -207348,7 +202828,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -207363,7 +202843,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -207394,7 +202874,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -207428,12 +202908,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -207445,9 +202921,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -207479,7 +202954,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -207528,14 +203003,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -207557,7 +203029,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -207583,17 +203055,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -207609,13 +203078,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -207678,7 +203147,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -207698,7 +203167,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -207709,7 +203178,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -207756,7 +203225,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -207776,7 +203245,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -207819,7 +203288,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -207828,7 +203297,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -207846,27 +203315,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -207925,9 +203397,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -207939,7 +203409,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -207971,8 +203441,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -208007,11 +203476,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -208021,10 +203487,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -208037,17 +203500,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -208067,8 +203530,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -208094,23 +203556,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -208176,7 +203636,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -208199,7 +203659,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -208250,7 +203710,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -208265,7 +203725,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -208280,7 +203740,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -208311,7 +203771,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -208345,12 +203805,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -208362,9 +203818,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -208396,7 +203851,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -208445,14 +203900,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -208474,7 +203926,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -208500,17 +203952,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -208526,13 +203975,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -208595,7 +204044,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -208615,7 +204064,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -208626,7 +204075,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -208673,7 +204122,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -208693,7 +204142,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -208736,7 +204185,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -208745,7 +204194,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -208763,27 +204212,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -208842,9 +204294,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -208856,7 +204306,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -208888,8 +204338,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -208924,11 +204373,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -208938,10 +204384,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -208954,17 +204397,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -208984,8 +204427,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -209011,23 +204453,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -209093,7 +204533,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -209116,7 +204556,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -209167,7 +204607,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -209182,7 +204622,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -209197,7 +204637,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -209228,7 +204668,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -209262,12 +204702,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -209279,9 +204715,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -209313,7 +204748,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -209362,14 +204797,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -209391,7 +204823,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -209417,17 +204849,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -209443,13 +204872,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -209512,7 +204941,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -209532,7 +204961,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -209543,7 +204972,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -209590,7 +205019,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -209610,7 +205039,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -209653,7 +205082,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -209662,7 +205091,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -209680,27 +205109,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -209759,9 +205191,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -209773,7 +205203,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -209805,8 +205235,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -209841,11 +205270,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -209855,10 +205281,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -209871,17 +205294,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -209901,8 +205324,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -209928,23 +205350,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -210010,7 +205430,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -210033,7 +205453,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -210084,7 +205504,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -210099,7 +205519,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -210114,7 +205534,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -210145,7 +205565,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -210179,12 +205599,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -210196,9 +205612,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -210230,7 +205645,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -210279,14 +205694,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -210308,7 +205720,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -210334,17 +205746,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -210360,13 +205769,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -210429,7 +205838,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -210449,7 +205858,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -210460,7 +205869,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -210507,7 +205916,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -210527,7 +205936,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -210570,7 +205979,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -210579,7 +205988,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -210597,27 +206006,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -210676,9 +206088,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -210690,7 +206100,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -210722,8 +206132,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -210758,11 +206167,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -210772,10 +206178,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -210788,17 +206191,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -210818,8 +206221,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -210845,23 +206247,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -210927,7 +206327,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -210950,7 +206350,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -211001,7 +206401,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -211016,7 +206416,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -211031,7 +206431,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -211062,7 +206462,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -211096,12 +206496,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -211113,9 +206509,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -211147,7 +206542,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -211196,14 +206591,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -211225,7 +206617,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -211251,17 +206643,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -211277,13 +206666,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -211346,7 +206735,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -211366,7 +206755,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -211377,7 +206766,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -211424,7 +206813,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -211444,7 +206833,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -211487,7 +206876,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -211496,7 +206885,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -211514,27 +206903,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -211593,9 +206985,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -211607,7 +206997,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -211639,8 +207029,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -211675,11 +207064,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -211689,10 +207075,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -211705,17 +207088,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -211735,8 +207118,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -211762,23 +207144,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -211844,7 +207224,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -211867,7 +207247,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -211918,7 +207298,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -211933,7 +207313,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -211948,7 +207328,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -211979,7 +207359,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -212013,12 +207393,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -212030,9 +207406,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -212064,7 +207439,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -212113,14 +207488,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -212142,7 +207514,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -212168,17 +207540,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -212194,13 +207563,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -212263,7 +207632,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -212283,7 +207652,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -212294,7 +207663,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -212341,7 +207710,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -212361,7 +207730,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -212404,7 +207773,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -212413,7 +207782,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -212431,27 +207800,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -212510,9 +207882,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -212524,7 +207894,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -212556,8 +207926,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -212592,11 +207961,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -212606,10 +207972,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -212622,17 +207985,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -212652,8 +208015,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -212679,23 +208041,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -212761,7 +208121,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -212784,7 +208144,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -212835,7 +208195,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -212850,7 +208210,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -212865,7 +208225,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -212896,7 +208256,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -212930,12 +208290,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -212947,9 +208303,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -212981,7 +208336,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -213030,14 +208385,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -213059,7 +208411,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -213085,17 +208437,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -213111,13 +208460,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -213180,7 +208529,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -213200,7 +208549,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -213211,7 +208560,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -213258,7 +208607,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -213278,7 +208627,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -213321,7 +208670,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -213330,7 +208679,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -213348,27 +208697,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -213427,9 +208779,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -213441,7 +208791,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -213473,8 +208823,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -213509,11 +208858,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -213523,10 +208869,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -213539,17 +208882,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -213569,8 +208912,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -213596,23 +208938,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -213678,7 +209018,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -213701,7 +209041,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -213752,7 +209092,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -213767,7 +209107,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -213782,7 +209122,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -213813,7 +209153,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -213847,12 +209187,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -213864,9 +209200,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -213898,7 +209233,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -213947,14 +209282,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -213976,7 +209308,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -214002,17 +209334,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -214028,13 +209357,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -214097,7 +209426,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -214117,7 +209446,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -214128,7 +209457,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -214175,7 +209504,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -214195,7 +209524,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -214238,7 +209567,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -214247,7 +209576,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -214265,27 +209594,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -214344,9 +209676,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -214358,7 +209688,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -214390,8 +209720,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -214426,11 +209755,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -214440,10 +209766,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -214456,17 +209779,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -214486,8 +209809,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -214513,23 +209835,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -214595,7 +209915,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -214618,7 +209938,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -214669,7 +209989,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -214684,7 +210004,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -214699,7 +210019,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -214730,7 +210050,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -214764,12 +210084,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -214781,9 +210097,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -214815,7 +210130,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -214864,14 +210179,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -214893,7 +210205,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -214919,17 +210231,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -214945,13 +210254,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -215014,7 +210323,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -215034,7 +210343,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -215045,7 +210354,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -215092,7 +210401,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -215112,7 +210421,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -215155,7 +210464,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -215164,7 +210473,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -215182,27 +210491,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -215261,9 +210573,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -215275,7 +210585,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -215307,8 +210617,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -215343,11 +210652,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -215357,10 +210663,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -215373,17 +210676,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -215403,8 +210706,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -215430,23 +210732,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -215512,7 +210812,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -215535,7 +210835,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -215586,7 +210886,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -215601,7 +210901,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -215616,7 +210916,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -215647,7 +210947,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -215681,12 +210981,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -215698,9 +210994,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -215732,7 +211027,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -215781,14 +211076,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -215810,7 +211102,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -215836,17 +211128,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -215862,13 +211151,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -215931,7 +211220,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -215951,7 +211240,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -215962,7 +211251,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -216009,7 +211298,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -216029,7 +211318,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -216072,7 +211361,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -216081,7 +211370,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -216099,27 +211388,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -216178,9 +211470,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -216192,7 +211482,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -216224,8 +211514,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -216260,11 +211549,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -216274,10 +211560,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -216290,17 +211573,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -216320,8 +211603,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -216347,23 +211629,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -216429,7 +211709,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -216452,7 +211732,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -216503,7 +211783,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -216518,7 +211798,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -216533,7 +211813,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -216564,7 +211844,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -216598,12 +211878,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -216615,9 +211891,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -216649,7 +211924,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -216698,14 +211973,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -216727,7 +211999,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -216753,17 +212025,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -216779,13 +212048,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -216848,7 +212117,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -216868,7 +212137,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -216879,7 +212148,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -216926,7 +212195,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -216946,7 +212215,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -216989,7 +212258,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -216998,7 +212267,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -217016,27 +212285,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -217095,9 +212367,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -217109,7 +212379,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -217141,8 +212411,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -217177,11 +212446,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -217191,10 +212457,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -217207,17 +212470,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -217237,8 +212500,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -217264,23 +212526,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -217346,7 +212606,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -217369,7 +212629,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -217420,7 +212680,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -217435,7 +212695,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -217450,7 +212710,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -217481,7 +212741,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -217515,12 +212775,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -217532,9 +212788,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -217566,7 +212821,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -217615,14 +212870,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -217644,7 +212896,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -217670,17 +212922,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -217696,13 +212945,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -217765,7 +213014,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -217785,7 +213034,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -217796,7 +213045,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -217843,7 +213092,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -217863,7 +213112,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -217906,7 +213155,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -217915,7 +213164,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -217933,27 +213182,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -218012,9 +213264,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -218026,7 +213276,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -218058,8 +213308,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -218094,11 +213343,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -218108,10 +213354,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -218124,17 +213367,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -218154,8 +213397,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -218181,23 +213423,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -218263,7 +213503,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -218286,7 +213526,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -218337,7 +213577,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -218352,7 +213592,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -218367,7 +213607,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -218398,7 +213638,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -218432,12 +213672,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -218449,9 +213685,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -218483,7 +213718,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -218532,14 +213767,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -218561,7 +213793,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -218587,17 +213819,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -218613,13 +213842,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -218682,7 +213911,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -218702,7 +213931,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -218713,7 +213942,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -218760,7 +213989,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -218780,7 +214009,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -218823,7 +214052,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -218832,7 +214061,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -218850,27 +214079,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -218929,9 +214161,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -218943,7 +214173,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -218975,8 +214205,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -219011,11 +214240,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -219025,10 +214251,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -219041,17 +214264,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -219071,8 +214294,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -219098,23 +214320,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -219180,7 +214400,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -219203,7 +214423,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -219254,7 +214474,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -219269,7 +214489,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -219284,7 +214504,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -219315,7 +214535,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -219349,12 +214569,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -219366,9 +214582,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -219400,7 +214615,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -219449,14 +214664,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -219478,7 +214690,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -219504,17 +214716,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -219530,13 +214739,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -219599,7 +214808,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -219619,7 +214828,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -219630,7 +214839,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -219677,7 +214886,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -219697,7 +214906,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -219740,7 +214949,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -219749,7 +214958,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -219767,27 +214976,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -219846,9 +215058,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -219860,7 +215070,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -219892,8 +215102,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -219928,11 +215137,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -219942,10 +215148,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -219958,17 +215161,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -219988,8 +215191,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -220015,23 +215217,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -220097,7 +215297,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -220120,7 +215320,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -220171,7 +215371,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -220186,7 +215386,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -220201,7 +215401,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -220232,7 +215432,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -220266,12 +215466,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -220283,9 +215479,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -220317,7 +215512,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -220366,14 +215561,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -220395,7 +215587,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -220421,17 +215613,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -220447,13 +215636,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -220516,7 +215705,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -220536,7 +215725,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -220547,7 +215736,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -220594,7 +215783,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -220614,7 +215803,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -220657,7 +215846,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -220666,7 +215855,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -220684,27 +215873,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -220763,9 +215955,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -220777,7 +215967,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -220809,8 +215999,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -220845,11 +216034,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -220859,10 +216045,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -220875,17 +216058,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -220905,8 +216088,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -220932,23 +216114,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -221014,7 +216194,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -221037,7 +216217,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -221088,7 +216268,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -221103,7 +216283,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -221118,7 +216298,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -221149,7 +216329,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -221183,12 +216363,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -221200,9 +216376,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -221234,7 +216409,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -221283,14 +216458,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -221312,7 +216484,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -221338,17 +216510,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -221364,13 +216533,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -221433,7 +216602,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -221453,7 +216622,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -221464,7 +216633,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -221511,7 +216680,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -221531,7 +216700,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -221574,7 +216743,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -221583,7 +216752,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -221601,27 +216770,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -221680,9 +216852,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -221694,7 +216864,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -221726,8 +216896,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -221762,11 +216931,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -221776,10 +216942,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -221792,17 +216955,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -221822,8 +216985,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -221849,23 +217011,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -221931,7 +217091,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -221954,7 +217114,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -222005,7 +217165,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -222020,7 +217180,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -222035,7 +217195,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -222066,7 +217226,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -222100,12 +217260,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -222117,9 +217273,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -222151,7 +217306,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -222200,14 +217355,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -222229,7 +217381,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -222255,17 +217407,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -222281,13 +217430,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -222350,7 +217499,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -222370,7 +217519,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -222381,7 +217530,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -222428,7 +217577,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -222448,7 +217597,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -222491,7 +217640,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -222500,7 +217649,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -222518,27 +217667,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -222597,9 +217749,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -222611,7 +217761,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -222643,8 +217793,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -222679,11 +217828,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -222693,10 +217839,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -222709,17 +217852,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -222739,8 +217882,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -222766,23 +217908,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -222848,7 +217988,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -222871,7 +218011,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -222922,7 +218062,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -222937,7 +218077,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -222952,7 +218092,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -222983,7 +218123,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -223017,12 +218157,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -223034,9 +218170,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -223068,7 +218203,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -223117,14 +218252,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -223146,7 +218278,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -223172,17 +218304,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -223198,13 +218327,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -223267,7 +218396,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -223287,7 +218416,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -223298,7 +218427,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -223345,7 +218474,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -223365,7 +218494,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -223408,7 +218537,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -223417,7 +218546,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -223435,27 +218564,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -223514,9 +218646,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -223528,7 +218658,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -223560,8 +218690,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -223596,11 +218725,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -223610,10 +218736,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -223626,17 +218749,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -223656,8 +218779,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -223683,23 +218805,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -223765,7 +218885,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -223788,7 +218908,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -223839,7 +218959,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -223854,7 +218974,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -223869,7 +218989,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -223900,7 +219020,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -223934,12 +219054,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -223951,9 +219067,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -223985,7 +219100,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -224034,14 +219149,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -224063,7 +219175,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -224089,17 +219201,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -224115,13 +219224,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -224184,7 +219293,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -224204,7 +219313,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -224215,7 +219324,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -224262,7 +219371,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -224282,7 +219391,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -224325,7 +219434,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -224334,7 +219443,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -224352,27 +219461,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -224431,9 +219543,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -224445,7 +219555,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -224477,8 +219587,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -224513,11 +219622,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -224527,10 +219633,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -224543,17 +219646,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -224573,8 +219676,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -224600,23 +219702,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -224682,7 +219782,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -224705,7 +219805,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -224756,7 +219856,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -224771,7 +219871,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -224786,7 +219886,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -224817,7 +219917,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -224851,12 +219951,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -224868,9 +219964,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -224902,7 +219997,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -224951,14 +220046,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -224980,7 +220072,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -225006,17 +220098,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -225032,13 +220121,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -225101,7 +220190,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -225121,7 +220210,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -225132,7 +220221,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -225179,7 +220268,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -225199,7 +220288,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -225242,7 +220331,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -225251,7 +220340,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -225269,27 +220358,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -225348,9 +220440,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -225362,7 +220452,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -225394,8 +220484,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -225430,11 +220519,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -225444,10 +220530,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -225460,17 +220543,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -225490,8 +220573,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -225517,23 +220599,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -225599,7 +220679,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -225622,7 +220702,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -225673,7 +220753,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -225688,7 +220768,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -225703,7 +220783,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -225734,7 +220814,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -225768,12 +220848,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -225785,9 +220861,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -225819,7 +220894,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -225868,14 +220943,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -225897,7 +220969,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -225923,17 +220995,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -225949,13 +221018,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -226018,7 +221087,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -226038,7 +221107,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -226049,7 +221118,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -226096,7 +221165,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -226116,7 +221185,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -226159,7 +221228,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -226168,7 +221237,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -226186,27 +221255,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -226265,9 +221337,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -226279,7 +221349,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -226311,8 +221381,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -226347,11 +221416,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -226361,10 +221427,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -226377,17 +221440,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -226407,8 +221470,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -226434,23 +221496,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -226516,7 +221576,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -226539,7 +221599,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -226590,7 +221650,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -226605,7 +221665,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -226620,7 +221680,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -226651,7 +221711,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -226685,12 +221745,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -226702,9 +221758,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -226736,7 +221791,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -226785,14 +221840,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -226814,7 +221866,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -226840,17 +221892,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -226866,13 +221915,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -226935,7 +221984,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -226955,7 +222004,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -226966,7 +222015,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -227013,7 +222062,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -227033,7 +222082,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -227076,7 +222125,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -227085,7 +222134,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -227103,27 +222152,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -227182,9 +222234,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -227196,7 +222246,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -227228,8 +222278,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -227264,11 +222313,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -227278,10 +222324,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -227294,17 +222337,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -227324,8 +222367,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -227351,23 +222393,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -227433,7 +222473,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -227456,7 +222496,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -227507,7 +222547,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -227522,7 +222562,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -227537,7 +222577,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -227568,7 +222608,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -227602,12 +222642,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -227619,9 +222655,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -227653,7 +222688,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -227702,14 +222737,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -227731,7 +222763,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -227757,17 +222789,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -227783,13 +222812,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -227852,7 +222881,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -227872,7 +222901,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -227883,7 +222912,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -227930,7 +222959,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -227950,7 +222979,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -227993,7 +223022,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -228002,7 +223031,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -228020,27 +223049,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -228099,9 +223131,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -228113,7 +223143,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -228145,8 +223175,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -228181,11 +223210,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -228195,10 +223221,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -228211,17 +223234,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -228241,8 +223264,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -228268,23 +223290,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -228350,7 +223370,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -228373,7 +223393,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -228424,7 +223444,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -228439,7 +223459,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -228454,7 +223474,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -228485,7 +223505,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -228519,12 +223539,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -228536,9 +223552,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -228570,7 +223585,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -228619,14 +223634,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -228648,7 +223660,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -228674,17 +223686,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -228700,13 +223709,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -228769,7 +223778,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -228789,7 +223798,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -228800,7 +223809,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -228847,7 +223856,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -228867,7 +223876,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -228910,7 +223919,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -228919,7 +223928,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -228937,27 +223946,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -229016,9 +224028,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -229030,7 +224040,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -229062,8 +224072,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -229098,11 +224107,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -229112,10 +224118,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -229128,17 +224131,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -229158,8 +224161,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -229185,23 +224187,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -229267,7 +224267,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -229290,7 +224290,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -229341,7 +224341,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -229356,7 +224356,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -229371,7 +224371,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -229402,7 +224402,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -229436,12 +224436,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -229453,9 +224449,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -229487,7 +224482,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -229536,14 +224531,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -229565,7 +224557,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -229591,17 +224583,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -229617,13 +224606,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -229686,7 +224675,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -229706,7 +224695,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -229717,7 +224706,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -229764,7 +224753,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -229784,7 +224773,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -229827,7 +224816,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -229836,7 +224825,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -229854,27 +224843,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -229933,9 +224925,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -229947,7 +224937,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -229979,8 +224969,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -230015,11 +225004,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -230029,10 +225015,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -230045,17 +225028,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -230075,8 +225058,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -230102,23 +225084,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -230184,7 +225164,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -230207,7 +225187,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -230258,7 +225238,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -230273,7 +225253,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -230288,7 +225268,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -230319,7 +225299,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -230353,12 +225333,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -230370,9 +225346,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -230404,7 +225379,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -230453,14 +225428,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -230482,7 +225454,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -230508,17 +225480,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -230534,13 +225503,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -230603,7 +225572,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -230623,7 +225592,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -230634,7 +225603,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -230681,7 +225650,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -230701,7 +225670,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -230744,7 +225713,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -230753,7 +225722,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -230771,27 +225740,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -230850,9 +225822,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -230864,7 +225834,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -230896,8 +225866,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -230932,11 +225901,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -230946,10 +225912,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -230962,17 +225925,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -230992,8 +225955,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -231019,23 +225981,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -231101,7 +226061,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -231124,7 +226084,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -231175,7 +226135,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -231190,7 +226150,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -231205,7 +226165,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -231236,7 +226196,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -231270,12 +226230,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -231287,9 +226243,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -231321,7 +226276,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -231370,14 +226325,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -231399,7 +226351,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -231425,17 +226377,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -231451,13 +226400,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -231520,7 +226469,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -231540,7 +226489,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -231551,7 +226500,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -231598,7 +226547,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -231618,7 +226567,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -231661,7 +226610,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -231670,7 +226619,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -231688,27 +226637,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -231767,9 +226719,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -231781,7 +226731,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -231813,8 +226763,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -231849,11 +226798,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -231863,10 +226809,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -231879,17 +226822,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -231909,8 +226852,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -231936,23 +226878,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -232018,7 +226958,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -232041,7 +226981,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -232092,7 +227032,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -232107,7 +227047,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -232122,7 +227062,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -232153,7 +227093,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -232187,12 +227127,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -232204,9 +227140,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -232238,7 +227173,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -232287,14 +227222,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -232316,7 +227248,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -232342,17 +227274,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -232368,13 +227297,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -232437,7 +227366,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -232457,7 +227386,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -232468,7 +227397,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -232515,7 +227444,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -232535,7 +227464,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -232578,7 +227507,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -232587,7 +227516,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -232605,27 +227534,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -232684,9 +227616,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -232698,7 +227628,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -232730,8 +227660,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -232766,11 +227695,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -232780,10 +227706,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -232796,17 +227719,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -232826,8 +227749,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -232853,23 +227775,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -232935,7 +227855,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -232958,7 +227878,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -233009,7 +227929,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -233024,7 +227944,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -233039,7 +227959,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -233070,7 +227990,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -233104,12 +228024,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -233121,9 +228037,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -233155,7 +228070,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -233204,14 +228119,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -233233,7 +228145,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -233259,17 +228171,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -233285,13 +228194,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -233354,7 +228263,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -233374,7 +228283,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -233385,7 +228294,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -233432,7 +228341,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -233452,7 +228361,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -233495,7 +228404,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -233504,7 +228413,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -233522,27 +228431,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -233601,9 +228513,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -233615,7 +228525,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -233647,8 +228557,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -233683,11 +228592,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -233697,10 +228603,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -233713,17 +228616,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -233743,8 +228646,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -233770,23 +228672,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -233852,7 +228752,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -233875,7 +228775,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -233926,7 +228826,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -233941,7 +228841,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -233956,7 +228856,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -233987,7 +228887,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -234021,12 +228921,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -234038,9 +228934,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -234072,7 +228967,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -234121,14 +229016,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -234150,7 +229042,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -234176,17 +229068,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -234202,13 +229091,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -234271,7 +229160,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -234291,7 +229180,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -234302,7 +229191,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -234349,7 +229238,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -234369,7 +229258,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -234412,7 +229301,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -234421,7 +229310,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -234439,27 +229328,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -234518,9 +229410,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -234532,7 +229422,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -234564,8 +229454,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -234600,11 +229489,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -234614,10 +229500,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -234630,17 +229513,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -234660,8 +229543,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -234687,23 +229569,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -234769,7 +229649,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -234792,7 +229672,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -234843,7 +229723,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -234858,7 +229738,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -234873,7 +229753,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -234904,7 +229784,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -234938,12 +229818,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -234955,9 +229831,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -234989,7 +229864,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -235038,14 +229913,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -235067,7 +229939,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -235093,17 +229965,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -235119,13 +229988,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -235188,7 +230057,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -235208,7 +230077,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -235219,7 +230088,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -235266,7 +230135,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -235286,7 +230155,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -235329,7 +230198,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -235338,7 +230207,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -235356,27 +230225,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -235435,9 +230307,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -235449,7 +230319,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -235481,8 +230351,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -235517,11 +230386,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -235531,10 +230397,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -235547,17 +230410,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -235577,8 +230440,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -235604,23 +230466,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -235686,7 +230546,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -235709,7 +230569,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -235760,7 +230620,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -235775,7 +230635,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -235790,7 +230650,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -235821,7 +230681,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -235855,12 +230715,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -235872,9 +230728,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -235906,7 +230761,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -235955,14 +230810,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -235984,7 +230836,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -236010,17 +230862,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -236036,13 +230885,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -236105,7 +230954,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -236125,7 +230974,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -236136,7 +230985,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -236183,7 +231032,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -236203,7 +231052,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -236246,7 +231095,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -236255,7 +231104,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -236273,27 +231122,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -236352,9 +231204,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -236366,7 +231216,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -236398,8 +231248,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -236434,11 +231283,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -236448,10 +231294,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -236464,17 +231307,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -236494,8 +231337,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -236521,23 +231363,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -236603,7 +231443,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -236626,7 +231466,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -236677,7 +231517,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -236692,7 +231532,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -236707,7 +231547,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -236738,7 +231578,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -236772,12 +231612,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -236789,9 +231625,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -236823,7 +231658,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -236872,14 +231707,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -236901,7 +231733,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -236927,17 +231759,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -236953,13 +231782,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -237022,7 +231851,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -237042,7 +231871,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -237053,7 +231882,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -237100,7 +231929,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -237120,7 +231949,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -237163,7 +231992,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -237172,7 +232001,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -237190,27 +232019,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -237269,9 +232101,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -237283,7 +232113,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -237315,8 +232145,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -237351,11 +232180,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -237365,10 +232191,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -237381,17 +232204,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -237411,8 +232234,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -237438,23 +232260,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -237520,7 +232340,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -237543,7 +232363,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -237594,7 +232414,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -237609,7 +232429,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -237624,7 +232444,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -237655,7 +232475,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -237689,12 +232509,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -237706,9 +232522,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -237740,7 +232555,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -237789,14 +232604,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -237818,7 +232630,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -237844,17 +232656,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -237870,13 +232679,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -237939,7 +232748,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -237959,7 +232768,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -237970,7 +232779,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -238017,7 +232826,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -238037,7 +232846,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -238080,7 +232889,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -238089,7 +232898,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -238107,27 +232916,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -238186,9 +232998,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -238200,7 +233010,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -238232,8 +233042,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -238268,11 +233077,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -238282,10 +233088,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -238298,17 +233101,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -238328,8 +233131,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -238355,23 +233157,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -238437,7 +233237,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -238460,7 +233260,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -238511,7 +233311,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -238526,7 +233326,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -238541,7 +233341,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -238572,7 +233372,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -238606,12 +233406,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -238623,9 +233419,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -238657,7 +233452,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -238706,14 +233501,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -238735,7 +233527,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -238761,17 +233553,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -238787,13 +233576,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -238856,7 +233645,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -238876,7 +233665,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -238887,7 +233676,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -238934,7 +233723,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -238954,7 +233743,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -238997,7 +233786,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -239006,7 +233795,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -239024,27 +233813,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -239103,9 +233895,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -239117,7 +233907,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -239149,8 +233939,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -239185,11 +233974,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -239199,10 +233985,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -239215,17 +233998,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -239245,8 +234028,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -239272,23 +234054,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -239354,7 +234134,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -239377,7 +234157,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -239428,7 +234208,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -239443,7 +234223,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -239458,7 +234238,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -239489,7 +234269,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -239523,12 +234303,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -239540,9 +234316,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -239574,7 +234349,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -239623,14 +234398,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -239652,7 +234424,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -239678,17 +234450,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -239704,13 +234473,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -239773,7 +234542,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -239793,7 +234562,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -239804,7 +234573,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -239851,7 +234620,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -239871,7 +234640,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -239914,7 +234683,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -239923,7 +234692,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -239941,27 +234710,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -240020,9 +234792,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -240034,7 +234804,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -240066,8 +234836,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -240102,11 +234871,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -240116,10 +234882,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -240132,17 +234895,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -240162,8 +234925,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -240189,23 +234951,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -240271,7 +235031,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -240294,7 +235054,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -240345,7 +235105,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -240360,7 +235120,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -240375,7 +235135,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -240406,7 +235166,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -240440,12 +235200,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -240457,9 +235213,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -240491,7 +235246,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -240540,14 +235295,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -240569,7 +235321,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -240595,17 +235347,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -240621,13 +235370,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -240690,7 +235439,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -240710,7 +235459,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -240721,7 +235470,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -240768,7 +235517,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -240788,7 +235537,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -240831,7 +235580,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -240840,7 +235589,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -240858,27 +235607,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -240937,9 +235689,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -240951,7 +235701,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -240983,8 +235733,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -241019,11 +235768,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -241033,10 +235779,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -241049,17 +235792,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -241079,8 +235822,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -241106,23 +235848,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -241188,7 +235928,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -241211,7 +235951,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -241262,7 +236002,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -241277,7 +236017,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -241292,7 +236032,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -241323,7 +236063,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -241357,12 +236097,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -241374,9 +236110,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -241408,7 +236143,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -241457,14 +236192,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -241486,7 +236218,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -241512,17 +236244,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -241538,13 +236267,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -241607,7 +236336,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -241627,7 +236356,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -241638,7 +236367,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -241685,7 +236414,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -241705,7 +236434,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -241748,7 +236477,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -241757,7 +236486,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -241775,27 +236504,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -241854,9 +236586,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -241868,7 +236598,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -241900,8 +236630,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -241936,11 +236665,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -241950,10 +236676,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -241966,17 +236689,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -241996,8 +236719,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -242023,23 +236745,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -242105,7 +236825,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -242128,7 +236848,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -242179,7 +236899,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -242194,7 +236914,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -242209,7 +236929,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -242240,7 +236960,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -242274,12 +236994,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -242291,9 +237007,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -242325,7 +237040,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -242374,14 +237089,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -242403,7 +237115,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -242429,17 +237141,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -242455,13 +237164,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -242524,7 +237233,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -242544,7 +237253,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -242555,7 +237264,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -242602,7 +237311,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -242622,7 +237331,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -242665,7 +237374,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -242674,7 +237383,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -242692,27 +237401,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -242771,9 +237483,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -242785,7 +237495,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -242817,8 +237527,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -242853,11 +237562,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -242867,10 +237573,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -242883,17 +237586,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -242913,8 +237616,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -242940,23 +237642,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -243022,7 +237722,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -243045,7 +237745,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -243096,7 +237796,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -243111,7 +237811,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -243126,7 +237826,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -243157,7 +237857,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -243191,12 +237891,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -243208,9 +237904,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -243242,7 +237937,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -243291,14 +237986,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -243320,7 +238012,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -243346,17 +238038,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -243372,13 +238061,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -243441,7 +238130,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -243461,7 +238150,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -243472,7 +238161,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -243519,7 +238208,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -243539,7 +238228,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -243582,7 +238271,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -243591,7 +238280,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -243609,27 +238298,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -243688,9 +238380,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -243702,7 +238392,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -243734,8 +238424,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -243770,11 +238459,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -243784,10 +238470,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -243800,17 +238483,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -243830,8 +238513,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -243857,23 +238539,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -243939,7 +238619,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -243962,7 +238642,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -244013,7 +238693,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -244028,7 +238708,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -244043,7 +238723,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -244074,7 +238754,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -244108,12 +238788,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -244125,9 +238801,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -244159,7 +238834,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -244208,14 +238883,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -244237,7 +238909,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -244263,17 +238935,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -244289,13 +238958,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -244358,7 +239027,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -244378,7 +239047,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -244389,7 +239058,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -244436,7 +239105,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -244456,7 +239125,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -244499,7 +239168,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -244508,7 +239177,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -244526,27 +239195,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -244605,9 +239277,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -244619,7 +239289,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -244651,8 +239321,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -244687,11 +239356,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -244701,10 +239367,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -244717,17 +239380,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -244747,8 +239410,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -244774,23 +239436,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -244856,7 +239516,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -244879,7 +239539,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -244930,7 +239590,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -244945,7 +239605,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -244960,7 +239620,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -244991,7 +239651,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -245025,12 +239685,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -245042,9 +239698,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -245076,7 +239731,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -245125,14 +239780,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -245154,7 +239806,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -245180,17 +239832,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -245206,13 +239855,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -245275,7 +239924,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -245295,7 +239944,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -245306,7 +239955,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -245353,7 +240002,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -245373,7 +240022,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -245416,7 +240065,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -245425,7 +240074,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -245443,27 +240092,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -245522,9 +240174,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -245536,7 +240186,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -245568,8 +240218,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -245604,11 +240253,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -245618,10 +240264,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -245634,17 +240277,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -245664,8 +240307,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -245691,23 +240333,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -245773,7 +240413,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -245796,7 +240436,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -245847,7 +240487,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -245862,7 +240502,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -245877,7 +240517,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -245908,7 +240548,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -245942,12 +240582,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -245959,9 +240595,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -245993,7 +240628,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -246042,14 +240677,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -246071,7 +240703,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -246097,17 +240729,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -246123,13 +240752,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -246192,7 +240821,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -246212,7 +240841,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -246223,7 +240852,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -246270,7 +240899,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -246290,7 +240919,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -246333,7 +240962,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -246342,7 +240971,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -246360,27 +240989,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -246439,9 +241071,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -246453,7 +241083,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -246485,8 +241115,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -246521,11 +241150,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -246535,10 +241161,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -246551,17 +241174,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -246581,8 +241204,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -246608,23 +241230,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -246690,7 +241310,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -246713,7 +241333,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -246764,7 +241384,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -246779,7 +241399,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -246794,7 +241414,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -246825,7 +241445,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -246859,12 +241479,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -246876,9 +241492,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -246910,7 +241525,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -246959,14 +241574,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -246988,7 +241600,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -247014,17 +241626,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -247040,13 +241649,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -247109,7 +241718,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -247129,7 +241738,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -247140,7 +241749,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -247187,7 +241796,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -247207,7 +241816,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -247250,7 +241859,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -247259,7 +241868,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -247277,27 +241886,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -247356,9 +241968,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -247370,7 +241980,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -247402,8 +242012,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -247438,11 +242047,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -247452,10 +242058,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -247468,17 +242071,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -247498,8 +242101,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -247525,23 +242127,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -247607,7 +242207,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -247630,7 +242230,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -247681,7 +242281,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -247696,7 +242296,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -247711,7 +242311,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -247742,7 +242342,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -247776,12 +242376,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -247793,9 +242389,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -247827,7 +242422,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -247876,14 +242471,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -247905,7 +242497,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -247931,17 +242523,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -247957,13 +242546,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -248026,7 +242615,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -248046,7 +242635,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -248057,7 +242646,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -248104,7 +242693,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -248124,7 +242713,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -248167,7 +242756,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -248176,7 +242765,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -248194,27 +242783,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -248273,9 +242865,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -248287,7 +242877,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -248319,8 +242909,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -248355,11 +242944,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -248369,10 +242955,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -248385,17 +242968,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -248415,8 +242998,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -248442,23 +243024,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -248524,7 +243104,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -248547,7 +243127,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -248598,7 +243178,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -248613,7 +243193,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -248628,7 +243208,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -248659,7 +243239,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -248693,12 +243273,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -248710,9 +243286,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -248744,7 +243319,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -248793,14 +243368,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -248822,7 +243394,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -248848,17 +243420,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -248874,13 +243443,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -248943,7 +243512,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -248963,7 +243532,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -248974,7 +243543,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -249021,7 +243590,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -249041,7 +243610,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -249084,7 +243653,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -249093,7 +243662,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -249111,27 +243680,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -249190,9 +243762,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -249204,7 +243774,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -249236,8 +243806,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -249272,11 +243841,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -249286,10 +243852,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -249302,17 +243865,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -249332,8 +243895,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -249359,23 +243921,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -249441,7 +244001,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -249464,7 +244024,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -249515,7 +244075,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -249530,7 +244090,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -249545,7 +244105,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -249576,7 +244136,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -249610,12 +244170,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -249627,9 +244183,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -249661,7 +244216,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -249710,14 +244265,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -249739,7 +244291,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -249765,17 +244317,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -249791,13 +244340,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -249860,7 +244409,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -249880,7 +244429,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -249891,7 +244440,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -249938,7 +244487,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -249958,7 +244507,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -250001,7 +244550,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -250010,7 +244559,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -250028,27 +244577,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -250107,9 +244659,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -250121,7 +244671,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -250153,8 +244703,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -250189,11 +244738,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -250203,10 +244749,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -250219,17 +244762,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -250249,8 +244792,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -250276,23 +244818,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -250358,7 +244898,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -250381,7 +244921,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -250432,7 +244972,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -250447,7 +244987,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -250462,7 +245002,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -250493,7 +245033,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -250527,12 +245067,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -250544,9 +245080,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -250578,7 +245113,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -250627,14 +245162,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -250656,7 +245188,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -250682,17 +245214,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -250708,13 +245237,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -250777,7 +245306,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -250797,7 +245326,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -250808,7 +245337,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -250855,7 +245384,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -250875,7 +245404,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -250918,7 +245447,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -250927,7 +245456,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -250945,27 +245474,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -251024,9 +245556,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -251038,7 +245568,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -251070,8 +245600,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -251106,11 +245635,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -251120,10 +245646,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -251136,17 +245659,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -251166,8 +245689,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -251193,23 +245715,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -251275,7 +245795,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -251298,7 +245818,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -251349,7 +245869,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -251364,7 +245884,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -251379,7 +245899,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -251410,7 +245930,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -251444,12 +245964,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -251461,9 +245977,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -251495,7 +246010,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -251544,14 +246059,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -251573,7 +246085,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -251599,17 +246111,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -251625,13 +246134,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -251694,7 +246203,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -251714,7 +246223,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -251725,7 +246234,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -251772,7 +246281,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -251792,7 +246301,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -251835,7 +246344,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -251844,7 +246353,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -251862,27 +246371,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -251941,9 +246453,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -251955,7 +246465,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -251987,8 +246497,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -252023,11 +246532,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -252037,10 +246543,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -252053,17 +246556,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -252083,8 +246586,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -252110,23 +246612,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -252192,7 +246692,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -252215,7 +246715,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -252266,7 +246766,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -252281,7 +246781,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -252296,7 +246796,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -252327,7 +246827,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -252361,12 +246861,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -252378,9 +246874,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -252412,7 +246907,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -252461,14 +246956,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -252490,7 +246982,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -252516,17 +247008,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -252542,13 +247031,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -252611,7 +247100,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -252631,7 +247120,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -252642,7 +247131,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -252689,7 +247178,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -252709,7 +247198,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -252752,7 +247241,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -252761,7 +247250,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -252779,27 +247268,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -252858,9 +247350,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -252872,7 +247362,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -252904,8 +247394,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -252940,11 +247429,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -252954,10 +247440,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -252970,17 +247453,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -253000,8 +247483,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -253027,23 +247509,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -253109,7 +247589,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -253132,7 +247612,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -253183,7 +247663,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -253198,7 +247678,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -253213,7 +247693,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -253244,7 +247724,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -253278,12 +247758,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -253295,9 +247771,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -253329,7 +247804,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -253378,14 +247853,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -253407,7 +247879,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -253433,17 +247905,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -253459,13 +247928,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -253528,7 +247997,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -253548,7 +248017,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -253559,7 +248028,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -253606,7 +248075,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -253626,7 +248095,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -253669,7 +248138,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -253678,7 +248147,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -253696,27 +248165,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -253775,9 +248247,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -253789,7 +248259,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -253821,8 +248291,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -253857,11 +248326,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -253871,10 +248337,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -253887,17 +248350,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -253917,8 +248380,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -253944,23 +248406,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -254026,7 +248486,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -254049,7 +248509,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -254100,7 +248560,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -254115,7 +248575,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -254130,7 +248590,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -254161,7 +248621,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -254195,12 +248655,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -254212,9 +248668,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -254246,7 +248701,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -254295,14 +248750,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -254324,7 +248776,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -254350,17 +248802,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -254376,13 +248825,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -254445,7 +248894,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -254465,7 +248914,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -254476,7 +248925,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -254523,7 +248972,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -254543,7 +248992,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -254586,7 +249035,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -254595,7 +249044,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -254613,27 +249062,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -254692,9 +249144,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -254706,7 +249156,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -254738,8 +249188,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -254774,11 +249223,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -254788,10 +249234,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -254804,17 +249247,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -254834,8 +249277,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -254861,23 +249303,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -254943,7 +249383,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -254966,7 +249406,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -255017,7 +249457,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -255032,7 +249472,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -255047,7 +249487,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -255078,7 +249518,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -255112,12 +249552,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -255129,9 +249565,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -255163,7 +249598,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -255212,14 +249647,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -255241,7 +249673,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -255267,17 +249699,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -255293,13 +249722,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -255362,7 +249791,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -255382,7 +249811,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -255393,7 +249822,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -255440,7 +249869,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -255460,7 +249889,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -255503,7 +249932,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -255512,7 +249941,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -255530,27 +249959,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -255609,9 +250041,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -255623,7 +250053,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -255655,8 +250085,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -255691,11 +250120,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -255705,10 +250131,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -255721,17 +250144,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -255751,8 +250174,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -255778,23 +250200,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -255860,7 +250280,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -255883,7 +250303,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -255934,7 +250354,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -255949,7 +250369,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -255964,7 +250384,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -255995,7 +250415,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -256029,12 +250449,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -256046,9 +250462,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -256080,7 +250495,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -256129,14 +250544,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -256158,7 +250570,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -256184,17 +250596,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -256210,13 +250619,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -256279,7 +250688,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -256299,7 +250708,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -256310,7 +250719,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -256357,7 +250766,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -256377,7 +250786,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -256420,7 +250829,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -256429,7 +250838,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -256447,27 +250856,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -256526,9 +250938,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -256540,7 +250950,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -256572,8 +250982,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -256608,11 +251017,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -256622,10 +251028,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -256638,17 +251041,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -256668,8 +251071,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -256695,23 +251097,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -256777,7 +251177,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -256800,7 +251200,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -256851,7 +251251,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -256866,7 +251266,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -256881,7 +251281,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -256912,7 +251312,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -256946,12 +251346,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -256963,9 +251359,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -256997,7 +251392,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -257046,14 +251441,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -257075,7 +251467,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -257101,17 +251493,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -257127,13 +251516,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -257196,7 +251585,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -257216,7 +251605,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -257227,7 +251616,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -257274,7 +251663,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -257294,7 +251683,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -257337,7 +251726,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -257346,7 +251735,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -257364,27 +251753,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -257443,9 +251835,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -257457,7 +251847,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -257489,8 +251879,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -257525,11 +251914,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -257539,10 +251925,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -257555,17 +251938,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -257585,8 +251968,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -257612,23 +251994,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -257694,7 +252074,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -257717,7 +252097,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -257768,7 +252148,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -257783,7 +252163,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -257798,7 +252178,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -257829,7 +252209,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -257863,12 +252243,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -257880,9 +252256,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -257914,7 +252289,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -257963,14 +252338,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -257992,7 +252364,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -258018,17 +252390,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -258044,13 +252413,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -258113,7 +252482,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -258133,7 +252502,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -258144,7 +252513,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -258191,7 +252560,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -258211,7 +252580,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -258254,7 +252623,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -258263,7 +252632,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -258281,27 +252650,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -258360,9 +252732,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -258374,7 +252744,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -258406,8 +252776,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -258442,11 +252811,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -258456,10 +252822,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -258472,17 +252835,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -258502,8 +252865,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -258529,23 +252891,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -258611,7 +252971,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -258634,7 +252994,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -258685,7 +253045,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -258700,7 +253060,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -258715,7 +253075,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -258746,7 +253106,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -258780,12 +253140,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -258797,9 +253153,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -258831,7 +253186,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -258880,14 +253235,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -258909,7 +253261,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -258935,17 +253287,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -258961,13 +253310,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -259030,7 +253379,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -259050,7 +253399,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -259061,7 +253410,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -259108,7 +253457,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -259128,7 +253477,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -259171,7 +253520,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -259180,7 +253529,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -259198,27 +253547,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -259277,9 +253629,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -259291,7 +253641,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -259323,8 +253673,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -259359,11 +253708,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -259373,10 +253719,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -259389,17 +253732,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -259419,8 +253762,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -259446,23 +253788,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -259528,7 +253868,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -259551,7 +253891,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -259602,7 +253942,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -259617,7 +253957,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -259632,7 +253972,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -259663,7 +254003,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -259697,12 +254037,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -259714,9 +254050,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -259748,7 +254083,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -259797,14 +254132,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -259826,7 +254158,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -259852,17 +254184,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -259878,13 +254207,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -259947,7 +254276,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -259967,7 +254296,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -259978,7 +254307,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -260025,7 +254354,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -260045,7 +254374,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -260088,7 +254417,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -260097,7 +254426,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -260115,27 +254444,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -260194,9 +254526,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -260208,7 +254538,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -260240,8 +254570,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -260276,11 +254605,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -260290,10 +254616,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -260306,17 +254629,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -260336,8 +254659,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -260363,23 +254685,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -260445,7 +254765,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -260468,7 +254788,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -260519,7 +254839,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -260534,7 +254854,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -260549,7 +254869,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -260580,7 +254900,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -260614,12 +254934,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -260631,9 +254947,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -260665,7 +254980,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -260714,14 +255029,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -260743,7 +255055,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -260769,17 +255081,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -260795,13 +255104,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -260864,7 +255173,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -260884,7 +255193,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -260895,7 +255204,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -260942,7 +255251,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -260962,7 +255271,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -261005,7 +255314,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -261014,7 +255323,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -261032,27 +255341,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -261111,9 +255423,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -261125,7 +255435,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -261157,8 +255467,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -261193,11 +255502,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -261207,10 +255513,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -261223,17 +255526,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -261253,8 +255556,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -261280,23 +255582,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -261362,7 +255662,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -261385,7 +255685,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -261436,7 +255736,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -261451,7 +255751,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -261466,7 +255766,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -261497,7 +255797,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -261531,12 +255831,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -261548,9 +255844,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -261582,7 +255877,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -261631,14 +255926,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -261660,7 +255952,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -261686,17 +255978,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -261712,13 +256001,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -261781,7 +256070,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -261801,7 +256090,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -261812,7 +256101,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -261859,7 +256148,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -261879,7 +256168,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -261922,7 +256211,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -261931,7 +256220,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -261949,27 +256238,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -262028,9 +256320,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -262042,7 +256332,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -262074,8 +256364,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -262110,11 +256399,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -262124,10 +256410,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -262140,17 +256423,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -262170,8 +256453,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -262197,23 +256479,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -262279,7 +256559,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -262302,7 +256582,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -262353,7 +256633,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -262368,7 +256648,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -262383,7 +256663,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -262414,7 +256694,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -262448,12 +256728,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -262465,9 +256741,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -262499,7 +256774,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -262548,14 +256823,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -262577,7 +256849,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -262603,17 +256875,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -262629,13 +256898,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -262698,7 +256967,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -262718,7 +256987,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -262729,7 +256998,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -262776,7 +257045,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -262796,7 +257065,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -262839,7 +257108,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -262848,7 +257117,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -262866,27 +257135,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -262945,9 +257217,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -262959,7 +257229,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -262991,8 +257261,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -263027,11 +257296,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -263041,10 +257307,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -263057,17 +257320,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -263087,8 +257350,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -263114,23 +257376,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -263196,7 +257456,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -263219,7 +257479,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -263270,7 +257530,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -263285,7 +257545,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -263300,7 +257560,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -263331,7 +257591,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -263365,12 +257625,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -263382,9 +257638,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -263416,7 +257671,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -263465,14 +257720,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -263494,7 +257746,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -263520,17 +257772,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -263546,13 +257795,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -263615,7 +257864,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -263635,7 +257884,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -263646,7 +257895,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -263693,7 +257942,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -263713,7 +257962,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -263756,7 +258005,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -263765,7 +258014,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -263783,27 +258032,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -263862,9 +258114,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -263876,7 +258126,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -263908,8 +258158,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -263944,11 +258193,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -263958,10 +258204,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -263974,17 +258217,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -264004,8 +258247,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -264031,23 +258273,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -264113,7 +258353,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -264136,7 +258376,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -264187,7 +258427,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -264202,7 +258442,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -264217,7 +258457,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -264248,7 +258488,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -264282,12 +258522,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -264299,9 +258535,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -264333,7 +258568,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -264382,14 +258617,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -264411,7 +258643,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -264437,17 +258669,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -264463,13 +258692,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -264532,7 +258761,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -264552,7 +258781,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -264563,7 +258792,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -264610,7 +258839,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -264630,7 +258859,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -264673,7 +258902,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -264682,7 +258911,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -264700,27 +258929,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -264779,9 +259011,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -264793,7 +259023,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -264825,8 +259055,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -264861,11 +259090,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -264875,10 +259101,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -264891,17 +259114,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -264921,8 +259144,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -264948,23 +259170,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -265030,7 +259250,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -265053,7 +259273,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -265104,7 +259324,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -265119,7 +259339,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -265134,7 +259354,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -265165,7 +259385,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -265199,12 +259419,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -265216,9 +259432,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -265250,7 +259465,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -265299,14 +259514,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -265328,7 +259540,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -265354,17 +259566,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -265380,13 +259589,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -265449,7 +259658,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -265469,7 +259678,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -265480,7 +259689,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -265527,7 +259736,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -265547,7 +259756,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -265590,7 +259799,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -265599,7 +259808,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -265617,27 +259826,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -265696,9 +259908,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -265710,7 +259920,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -265742,8 +259952,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -265778,11 +259987,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -265792,10 +259998,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -265808,17 +260011,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -265838,8 +260041,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -265865,23 +260067,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -265947,7 +260147,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -265970,7 +260170,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -266021,7 +260221,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -266036,7 +260236,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -266051,7 +260251,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -266082,7 +260282,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -266116,12 +260316,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -266133,9 +260329,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -266167,7 +260362,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -266216,14 +260411,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -266245,7 +260437,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -266271,17 +260463,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -266297,13 +260486,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -266366,7 +260555,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -266386,7 +260575,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -266397,7 +260586,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -266444,7 +260633,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -266464,7 +260653,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -266507,7 +260696,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -266516,7 +260705,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -266534,27 +260723,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -266613,9 +260805,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -266627,7 +260817,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -266659,8 +260849,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -266695,11 +260884,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -266709,10 +260895,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -266725,17 +260908,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -266755,8 +260938,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -266782,23 +260964,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -266864,7 +261044,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -266887,7 +261067,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -266938,7 +261118,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -266953,7 +261133,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -266968,7 +261148,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -266999,7 +261179,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -267033,12 +261213,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -267050,9 +261226,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -267084,7 +261259,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -267133,14 +261308,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -267162,7 +261334,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -267188,17 +261360,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -267214,13 +261383,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -267283,7 +261452,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -267303,7 +261472,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -267314,7 +261483,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -267361,7 +261530,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -267381,7 +261550,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -267424,7 +261593,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -267433,7 +261602,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -267451,27 +261620,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -267530,9 +261702,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -267544,7 +261714,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -267576,8 +261746,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -267612,11 +261781,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -267626,10 +261792,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -267642,17 +261805,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -267672,8 +261835,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -267699,23 +261861,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -267781,7 +261941,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -267804,7 +261964,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -267855,7 +262015,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -267870,7 +262030,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -267885,7 +262045,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -267916,7 +262076,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -267950,12 +262110,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -267967,9 +262123,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -268001,7 +262156,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -268050,14 +262205,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -268079,7 +262231,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -268105,17 +262257,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -268131,13 +262280,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -268200,7 +262349,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -268220,7 +262369,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -268231,7 +262380,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -268278,7 +262427,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -268298,7 +262447,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -268341,7 +262490,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -268350,7 +262499,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -268368,27 +262517,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -268447,9 +262599,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -268461,7 +262611,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -268493,8 +262643,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -268529,11 +262678,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -268543,10 +262689,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -268559,17 +262702,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -268589,8 +262732,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -268616,23 +262758,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -268698,7 +262838,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -268721,7 +262861,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -268772,7 +262912,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -268787,7 +262927,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -268802,7 +262942,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -268833,7 +262973,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -268867,12 +263007,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -268884,9 +263020,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -268918,7 +263053,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -268967,14 +263102,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -268996,7 +263128,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -269022,17 +263154,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -269048,13 +263177,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -269117,7 +263246,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -269137,7 +263266,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -269148,7 +263277,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -269195,7 +263324,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -269215,7 +263344,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -269258,7 +263387,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -269267,7 +263396,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -269285,27 +263414,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -269364,9 +263496,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -269378,7 +263508,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -269410,8 +263540,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -269446,11 +263575,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -269460,10 +263586,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -269476,17 +263599,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -269506,8 +263629,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -269533,23 +263655,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -269615,7 +263735,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -269638,7 +263758,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -269689,7 +263809,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -269704,7 +263824,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -269719,7 +263839,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -269750,7 +263870,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -269784,12 +263904,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -269801,9 +263917,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -269835,7 +263950,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -269884,14 +263999,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -269913,7 +264025,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -269939,17 +264051,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -269965,13 +264074,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -270034,7 +264143,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -270054,7 +264163,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -270065,7 +264174,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -270112,7 +264221,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -270132,7 +264241,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -270175,7 +264284,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -270184,7 +264293,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -270202,27 +264311,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -270281,9 +264393,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -270295,7 +264405,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -270327,8 +264437,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -270363,11 +264472,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -270377,10 +264483,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -270393,17 +264496,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -270423,8 +264526,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -270450,23 +264552,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -270532,7 +264632,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -270555,7 +264655,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -270606,7 +264706,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -270621,7 +264721,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -270636,7 +264736,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -270667,7 +264767,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -270701,12 +264801,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -270718,9 +264814,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -270752,7 +264847,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -270801,14 +264896,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -270830,7 +264922,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -270856,17 +264948,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -270882,13 +264971,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -270951,7 +265040,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -270971,7 +265060,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -270982,7 +265071,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -271029,7 +265118,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -271049,7 +265138,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -271092,7 +265181,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -271101,7 +265190,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -271119,27 +265208,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -271198,9 +265290,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -271212,7 +265302,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -271244,8 +265334,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -271280,11 +265369,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -271294,10 +265380,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -271310,17 +265393,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -271340,8 +265423,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -271367,23 +265449,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -271449,7 +265529,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -271472,7 +265552,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -271523,7 +265603,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -271538,7 +265618,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -271553,7 +265633,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -271584,7 +265664,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -271618,12 +265698,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -271635,9 +265711,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -271669,7 +265744,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -271718,14 +265793,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -271747,7 +265819,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -271773,17 +265845,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -271799,13 +265868,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -271868,7 +265937,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -271888,7 +265957,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -271899,7 +265968,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -271946,7 +266015,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -271966,7 +266035,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -272009,7 +266078,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -272018,7 +266087,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -272036,27 +266105,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -272115,9 +266187,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -272129,7 +266199,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -272161,8 +266231,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -272197,11 +266266,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -272211,10 +266277,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -272227,17 +266290,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -272257,8 +266320,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -272284,23 +266346,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -272366,7 +266426,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -272389,7 +266449,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -272440,7 +266500,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -272455,7 +266515,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -272470,7 +266530,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -272501,7 +266561,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -272535,12 +266595,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -272552,9 +266608,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -272586,7 +266641,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -272635,14 +266690,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -272664,7 +266716,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -272690,17 +266742,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -272716,13 +266765,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -272785,7 +266834,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -272805,7 +266854,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -272816,7 +266865,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -272863,7 +266912,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -272883,7 +266932,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -272926,7 +266975,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -272935,7 +266984,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -272953,27 +267002,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -273032,9 +267084,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -273046,7 +267096,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -273078,8 +267128,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -273114,11 +267163,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -273128,10 +267174,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -273144,17 +267187,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -273174,8 +267217,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -273201,23 +267243,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -273283,7 +267323,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -273306,7 +267346,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -273357,7 +267397,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -273372,7 +267412,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -273387,7 +267427,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -273418,7 +267458,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -273452,12 +267492,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -273469,9 +267505,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -273503,7 +267538,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -273552,14 +267587,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -273581,7 +267613,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -273607,17 +267639,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -273633,13 +267662,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -273702,7 +267731,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -273722,7 +267751,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -273733,7 +267762,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -273780,7 +267809,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -273800,7 +267829,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -273843,7 +267872,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -273852,7 +267881,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -273870,27 +267899,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -273949,9 +267981,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -273963,7 +267993,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -273995,8 +268025,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -274031,11 +268060,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -274045,10 +268071,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -274061,17 +268084,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -274091,8 +268114,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -274118,23 +268140,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -274200,7 +268220,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -274223,7 +268243,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -274274,7 +268294,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -274289,7 +268309,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -274304,7 +268324,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -274335,7 +268355,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -274369,12 +268389,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -274386,9 +268402,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -274420,7 +268435,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -274469,14 +268484,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -274498,7 +268510,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -274524,17 +268536,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -274550,13 +268559,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -274619,7 +268628,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -274639,7 +268648,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -274650,7 +268659,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -274697,7 +268706,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -274717,7 +268726,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -274760,7 +268769,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -274769,7 +268778,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -274787,27 +268796,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -274866,9 +268878,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -274880,7 +268890,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -274912,8 +268922,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -274948,11 +268957,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -274962,10 +268968,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -274978,17 +268981,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -275008,8 +269011,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -275035,23 +269037,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -275117,7 +269117,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -275140,7 +269140,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -275191,7 +269191,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -275206,7 +269206,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -275221,7 +269221,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -275252,7 +269252,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -275286,12 +269286,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -275303,9 +269299,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -275337,7 +269332,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -275386,14 +269381,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -275415,7 +269407,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -275441,17 +269433,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -275467,13 +269456,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -275536,7 +269525,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -275556,7 +269545,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -275567,7 +269556,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -275614,7 +269603,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -275634,7 +269623,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -275677,7 +269666,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -275686,7 +269675,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -275704,27 +269693,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -275783,9 +269775,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -275797,7 +269787,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -275829,8 +269819,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -275865,11 +269854,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -275879,10 +269865,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -275895,17 +269878,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -275925,8 +269908,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -275952,23 +269934,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -276034,7 +270014,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -276057,7 +270037,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -276108,7 +270088,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -276123,7 +270103,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -276138,7 +270118,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -276169,7 +270149,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -276203,12 +270183,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -276220,9 +270196,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -276254,7 +270229,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -276303,14 +270278,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -276332,7 +270304,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -276358,17 +270330,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -276384,13 +270353,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -276453,7 +270422,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -276473,7 +270442,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -276484,7 +270453,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -276531,7 +270500,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -276551,7 +270520,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -276594,7 +270563,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -276603,7 +270572,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -276621,27 +270590,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -276700,9 +270672,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -276714,7 +270684,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -276746,8 +270716,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -276782,11 +270751,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -276796,10 +270762,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -276812,17 +270775,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -276842,8 +270805,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -276869,23 +270831,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -276951,7 +270911,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -276974,7 +270934,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -277025,7 +270985,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -277040,7 +271000,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -277055,7 +271015,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -277086,7 +271046,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -277120,12 +271080,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -277137,9 +271093,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -277171,7 +271126,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -277220,14 +271175,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -277249,7 +271201,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -277275,17 +271227,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -277301,13 +271250,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -277370,7 +271319,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -277390,7 +271339,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -277401,7 +271350,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -277448,7 +271397,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -277468,7 +271417,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -277511,7 +271460,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -277520,7 +271469,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -277538,27 +271487,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -277617,9 +271569,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -277631,7 +271581,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -277663,8 +271613,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -277699,11 +271648,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -277713,10 +271659,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -277729,17 +271672,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -277759,8 +271702,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -277786,23 +271728,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -277868,7 +271808,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -277891,7 +271831,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -277942,7 +271882,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -277957,7 +271897,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -277972,7 +271912,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -278003,7 +271943,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -278037,12 +271977,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -278054,9 +271990,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -278088,7 +272023,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -278137,14 +272072,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -278166,7 +272098,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -278192,17 +272124,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -278218,13 +272147,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -278287,7 +272216,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -278307,7 +272236,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -278318,7 +272247,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -278365,7 +272294,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -278385,7 +272314,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -278428,7 +272357,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -278437,7 +272366,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -278455,27 +272384,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -278534,9 +272466,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -278548,7 +272478,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -278580,8 +272510,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -278616,11 +272545,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -278630,10 +272556,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -278646,17 +272569,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -278676,8 +272599,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -278703,23 +272625,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -278785,7 +272705,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -278808,7 +272728,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -278859,7 +272779,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -278874,7 +272794,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -278889,7 +272809,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -278920,7 +272840,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -278954,12 +272874,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -278971,9 +272887,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -279005,7 +272920,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -279054,14 +272969,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -279083,7 +272995,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -279109,17 +273021,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -279135,13 +273044,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -279204,7 +273113,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -279224,7 +273133,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -279235,7 +273144,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -279282,7 +273191,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -279302,7 +273211,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -279345,7 +273254,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -279354,7 +273263,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -279372,27 +273281,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -279451,9 +273363,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -279465,7 +273375,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -279497,8 +273407,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -279533,11 +273442,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -279547,10 +273453,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -279563,17 +273466,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -279593,8 +273496,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -279620,23 +273522,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -279702,7 +273602,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -279725,7 +273625,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -279776,7 +273676,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -279791,7 +273691,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -279806,7 +273706,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -279837,7 +273737,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -279871,12 +273771,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -279888,9 +273784,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -279922,7 +273817,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -279971,14 +273866,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -280000,7 +273892,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -280026,17 +273918,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -280052,13 +273941,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -280121,7 +274010,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -280141,7 +274030,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -280152,7 +274041,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -280199,7 +274088,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -280219,7 +274108,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -280262,7 +274151,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -280271,7 +274160,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -280289,27 +274178,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -280368,9 +274260,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -280382,7 +274272,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -280414,8 +274304,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -280450,11 +274339,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -280464,10 +274350,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -280480,17 +274363,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -280510,8 +274393,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -280537,23 +274419,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -280619,7 +274499,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -280642,7 +274522,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -280693,7 +274573,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -280708,7 +274588,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -280723,7 +274603,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -280754,7 +274634,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -280788,12 +274668,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -280805,9 +274681,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -280839,7 +274714,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -280888,14 +274763,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -280917,7 +274789,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -280943,17 +274815,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -280969,13 +274838,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -281038,7 +274907,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -281058,7 +274927,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -281069,7 +274938,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -281116,7 +274985,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -281136,7 +275005,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -281179,7 +275048,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -281188,7 +275057,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -281206,27 +275075,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -281285,9 +275157,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -281299,7 +275169,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -281331,8 +275201,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -281367,11 +275236,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -281381,10 +275247,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -281397,17 +275260,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -281427,8 +275290,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -281454,23 +275316,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -281536,7 +275396,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -281559,7 +275419,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -281610,7 +275470,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -281625,7 +275485,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -281640,7 +275500,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -281671,7 +275531,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -281705,12 +275565,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -281722,9 +275578,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -281756,7 +275611,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -281805,14 +275660,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -281834,7 +275686,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -281860,17 +275712,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -281886,13 +275735,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -281955,7 +275804,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -281975,7 +275824,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -281986,7 +275835,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -282033,7 +275882,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -282053,7 +275902,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -282096,7 +275945,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -282105,7 +275954,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -282123,27 +275972,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -282202,9 +276054,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -282216,7 +276066,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -282248,8 +276098,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -282284,11 +276133,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -282298,10 +276144,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -282314,17 +276157,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -282344,8 +276187,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -282371,23 +276213,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -282453,7 +276293,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -282476,7 +276316,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -282527,7 +276367,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -282542,7 +276382,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -282557,7 +276397,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -282588,7 +276428,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -282622,12 +276462,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -282639,9 +276475,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -282673,7 +276508,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -282722,14 +276557,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -282751,7 +276583,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -282777,17 +276609,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -282803,13 +276632,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -282872,7 +276701,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -282892,7 +276721,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -282903,7 +276732,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -282950,7 +276779,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -282970,7 +276799,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -283013,7 +276842,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -283022,7 +276851,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -283040,27 +276869,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -283119,9 +276951,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -283133,7 +276963,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -283165,8 +276995,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -283201,11 +277030,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -283215,10 +277041,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -283231,17 +277054,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -283261,8 +277084,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -283288,23 +277110,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -283370,7 +277190,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -283393,7 +277213,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -283444,7 +277264,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -283459,7 +277279,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -283474,7 +277294,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -283505,7 +277325,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -283539,12 +277359,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -283556,9 +277372,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -283590,7 +277405,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -283639,14 +277454,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -283668,7 +277480,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -283694,17 +277506,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -283720,13 +277529,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -283789,7 +277598,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -283809,7 +277618,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -283820,7 +277629,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -283867,7 +277676,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -283887,7 +277696,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -283930,7 +277739,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -283939,7 +277748,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -283957,27 +277766,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -284036,9 +277848,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -284050,7 +277860,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -284082,8 +277892,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -284118,11 +277927,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -284132,10 +277938,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -284148,17 +277951,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -284178,8 +277981,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -284205,23 +278007,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -284287,7 +278087,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -284310,7 +278110,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -284361,7 +278161,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -284376,7 +278176,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -284391,7 +278191,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -284422,7 +278222,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -284456,12 +278256,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -284473,9 +278269,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -284507,7 +278302,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -284556,14 +278351,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -284585,7 +278377,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -284611,17 +278403,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -284637,13 +278426,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -284706,7 +278495,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -284726,7 +278515,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -284737,7 +278526,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -284784,7 +278573,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -284804,7 +278593,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -284847,7 +278636,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -284856,7 +278645,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -284874,27 +278663,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -284953,9 +278745,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -284967,7 +278757,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -284999,8 +278789,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -285035,11 +278824,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -285049,10 +278835,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -285065,17 +278848,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -285095,8 +278878,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -285122,23 +278904,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -285204,7 +278984,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -285227,7 +279007,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -285278,7 +279058,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -285293,7 +279073,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -285308,7 +279088,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -285339,7 +279119,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -285373,12 +279153,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -285390,9 +279166,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -285424,7 +279199,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -285473,14 +279248,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -285502,7 +279274,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -285528,17 +279300,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -285554,13 +279323,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -285623,7 +279392,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -285643,7 +279412,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -285654,7 +279423,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -285701,7 +279470,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -285721,7 +279490,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -285764,7 +279533,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -285773,7 +279542,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -285791,27 +279560,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -285870,9 +279642,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -285884,7 +279654,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -285916,8 +279686,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -285952,11 +279721,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -285966,10 +279732,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -285982,17 +279745,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -286012,8 +279775,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -286039,23 +279801,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -286121,7 +279881,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -286144,7 +279904,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -286195,7 +279955,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -286210,7 +279970,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -286225,7 +279985,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -286256,7 +280016,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -286290,12 +280050,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -286307,9 +280063,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -286341,7 +280096,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -286390,14 +280145,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -286419,7 +280171,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -286445,17 +280197,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -286471,13 +280220,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -286540,7 +280289,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -286560,7 +280309,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -286571,7 +280320,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -286618,7 +280367,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -286638,7 +280387,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -286681,7 +280430,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -286690,7 +280439,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -286708,27 +280457,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -286787,9 +280539,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -286801,7 +280551,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -286833,8 +280583,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -286869,11 +280618,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -286883,10 +280629,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -286899,17 +280642,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -286929,8 +280672,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -286956,23 +280698,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -287038,7 +280778,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -287061,7 +280801,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -287112,7 +280852,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -287127,7 +280867,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -287142,7 +280882,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -287173,7 +280913,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -287207,12 +280947,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -287224,9 +280960,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -287258,7 +280993,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -287307,14 +281042,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -287336,7 +281068,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -287362,17 +281094,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -287388,13 +281117,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -287457,7 +281186,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -287477,7 +281206,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -287488,7 +281217,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -287535,7 +281264,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -287555,7 +281284,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -287598,7 +281327,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -287607,7 +281336,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -287625,27 +281354,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -287704,9 +281436,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -287718,7 +281448,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -287750,8 +281480,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -287786,11 +281515,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -287800,10 +281526,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -287816,17 +281539,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -287846,8 +281569,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -287873,23 +281595,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -287955,7 +281675,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -287978,7 +281698,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -288029,7 +281749,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -288044,7 +281764,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -288059,7 +281779,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -288090,7 +281810,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -288124,12 +281844,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -288141,9 +281857,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -288175,7 +281890,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -288224,14 +281939,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -288253,7 +281965,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -288279,17 +281991,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -288305,13 +282014,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -288374,7 +282083,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -288394,7 +282103,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -288405,7 +282114,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -288452,7 +282161,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -288472,7 +282181,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -288515,7 +282224,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -288524,7 +282233,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -288542,27 +282251,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -288621,9 +282333,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -288635,7 +282345,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -288667,8 +282377,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -288703,11 +282412,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -288717,10 +282423,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -288733,17 +282436,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -288763,8 +282466,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -288790,23 +282492,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -288872,7 +282572,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -288895,7 +282595,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -288946,7 +282646,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -288961,7 +282661,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -288976,7 +282676,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -289007,7 +282707,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -289041,12 +282741,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -289058,9 +282754,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -289092,7 +282787,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -289141,14 +282836,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -289170,7 +282862,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -289196,17 +282888,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -289222,13 +282911,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -289291,7 +282980,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -289311,7 +283000,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -289322,7 +283011,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -289369,7 +283058,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -289389,7 +283078,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -289432,7 +283121,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -289441,7 +283130,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -289459,27 +283148,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -289538,9 +283230,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -289552,7 +283242,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -289584,8 +283274,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -289620,11 +283309,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -289634,10 +283320,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -289650,17 +283333,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -289680,8 +283363,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -289707,23 +283389,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -289789,7 +283469,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -289812,7 +283492,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -289863,7 +283543,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -289878,7 +283558,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -289893,7 +283573,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -289924,7 +283604,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -289958,12 +283638,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -289975,9 +283651,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -290009,7 +283684,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -290058,14 +283733,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -290087,7 +283759,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -290113,17 +283785,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -290139,13 +283808,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -290208,7 +283877,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -290228,7 +283897,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -290239,7 +283908,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -290286,7 +283955,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -290306,7 +283975,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -290349,7 +284018,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -290358,7 +284027,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -290376,27 +284045,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -290455,9 +284127,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -290469,7 +284139,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -290501,8 +284171,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -290537,11 +284206,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -290551,10 +284217,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -290567,17 +284230,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -290597,8 +284260,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -290624,23 +284286,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -290706,7 +284366,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -290729,7 +284389,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -290780,7 +284440,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -290795,7 +284455,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -290810,7 +284470,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -290841,7 +284501,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -290875,12 +284535,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -290892,9 +284548,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -290926,7 +284581,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -290975,14 +284630,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -291004,7 +284656,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -291030,17 +284682,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -291056,13 +284705,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -291125,7 +284774,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -291145,7 +284794,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -291156,7 +284805,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -291203,7 +284852,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -291223,7 +284872,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -291266,7 +284915,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -291275,7 +284924,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -291293,27 +284942,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -291372,9 +285024,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -291386,7 +285036,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -291418,8 +285068,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -291454,11 +285103,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -291468,10 +285114,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -291484,17 +285127,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -291514,8 +285157,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -291541,23 +285183,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -291623,7 +285263,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -291646,7 +285286,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -291697,7 +285337,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -291712,7 +285352,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -291727,7 +285367,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -291758,7 +285398,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -291792,12 +285432,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -291809,9 +285445,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -291843,7 +285478,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -291892,14 +285527,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -291921,7 +285553,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -291947,17 +285579,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -291973,13 +285602,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -292042,7 +285671,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -292062,7 +285691,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -292073,7 +285702,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -292120,7 +285749,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -292140,7 +285769,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -292183,7 +285812,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -292192,7 +285821,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -292210,27 +285839,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -292289,9 +285921,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -292303,7 +285933,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -292335,8 +285965,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -292371,11 +286000,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -292385,10 +286011,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -292401,17 +286024,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -292431,8 +286054,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -292458,23 +286080,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -292540,7 +286160,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -292563,7 +286183,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -292614,7 +286234,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -292629,7 +286249,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -292644,7 +286264,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -292675,7 +286295,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -292709,12 +286329,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -292726,9 +286342,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -292760,7 +286375,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -292809,14 +286424,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -292838,7 +286450,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -292864,17 +286476,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -292890,13 +286499,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -292959,7 +286568,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -292979,7 +286588,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -292990,7 +286599,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -293037,7 +286646,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -293057,7 +286666,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -293100,7 +286709,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -293109,7 +286718,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -293127,27 +286736,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -293206,9 +286818,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -293220,7 +286830,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -293252,8 +286862,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -293288,11 +286897,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -293302,10 +286908,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -293318,17 +286921,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -293348,8 +286951,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -293375,23 +286977,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -293457,7 +287057,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -293480,7 +287080,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -293531,7 +287131,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -293546,7 +287146,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -293561,7 +287161,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -293592,7 +287192,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -293626,12 +287226,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -293643,9 +287239,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -293677,7 +287272,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -293726,14 +287321,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -293755,7 +287347,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -293781,17 +287373,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -293807,13 +287396,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -293876,7 +287465,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -293896,7 +287485,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -293907,7 +287496,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -293954,7 +287543,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -293974,7 +287563,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -294017,7 +287606,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -294026,7 +287615,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -294044,27 +287633,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -294123,9 +287715,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -294137,7 +287727,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -294169,8 +287759,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -294205,11 +287794,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -294219,10 +287805,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -294235,17 +287818,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -294265,8 +287848,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -294292,23 +287874,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -294374,7 +287954,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -294397,7 +287977,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -294448,7 +288028,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -294463,7 +288043,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -294478,7 +288058,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -294509,7 +288089,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -294543,12 +288123,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -294560,9 +288136,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -294594,7 +288169,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -294643,14 +288218,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -294672,7 +288244,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -294698,17 +288270,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -294724,13 +288293,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -294793,7 +288362,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -294813,7 +288382,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -294824,7 +288393,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -294871,7 +288440,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -294891,7 +288460,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -294934,7 +288503,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -294943,7 +288512,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -294961,27 +288530,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -295040,9 +288612,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -295054,7 +288624,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -295086,8 +288656,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -295122,11 +288691,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -295136,10 +288702,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -295152,17 +288715,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -295182,8 +288745,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -295209,23 +288771,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -295291,7 +288851,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -295314,7 +288874,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -295365,7 +288925,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -295380,7 +288940,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -295395,7 +288955,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -295426,7 +288986,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -295460,12 +289020,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -295477,9 +289033,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -295511,7 +289066,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -295560,14 +289115,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -295589,7 +289141,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -295615,17 +289167,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -295641,13 +289190,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -295710,7 +289259,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -295730,7 +289279,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -295741,7 +289290,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -295788,7 +289337,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -295808,7 +289357,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -295851,7 +289400,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -295860,7 +289409,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -295878,27 +289427,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -295957,9 +289509,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -295971,7 +289521,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -296003,8 +289553,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -296039,11 +289588,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -296053,10 +289599,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -296069,17 +289612,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -296099,8 +289642,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -296126,23 +289668,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -296208,7 +289748,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -296231,7 +289771,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -296282,7 +289822,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -296297,7 +289837,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -296312,7 +289852,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -296343,7 +289883,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -296377,12 +289917,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -296394,9 +289930,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -296428,7 +289963,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -296477,14 +290012,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -296506,7 +290038,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -296532,17 +290064,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -296558,13 +290087,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -296627,7 +290156,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -296647,7 +290176,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -296658,7 +290187,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -296705,7 +290234,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -296725,7 +290254,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -296768,7 +290297,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -296777,7 +290306,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -296795,27 +290324,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -296874,9 +290406,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -296888,7 +290418,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -296920,8 +290450,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -296956,11 +290485,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -296970,10 +290496,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -296986,17 +290509,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -297016,8 +290539,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -297043,23 +290565,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -297125,7 +290645,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -297148,7 +290668,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -297199,7 +290719,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -297214,7 +290734,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -297229,7 +290749,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -297260,7 +290780,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -297294,12 +290814,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -297311,9 +290827,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -297345,7 +290860,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -297394,14 +290909,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -297423,7 +290935,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -297449,17 +290961,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -297475,13 +290984,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -297544,7 +291053,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -297564,7 +291073,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -297575,7 +291084,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -297622,7 +291131,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -297642,7 +291151,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -297685,7 +291194,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -297694,7 +291203,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -297712,27 +291221,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -297791,9 +291303,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -297805,7 +291315,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -297837,8 +291347,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -297873,11 +291382,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -297887,10 +291393,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -297903,17 +291406,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -297933,8 +291436,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -297960,23 +291462,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -298042,7 +291542,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -298065,7 +291565,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -298116,7 +291616,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -298131,7 +291631,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -298146,7 +291646,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -298177,7 +291677,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -298211,12 +291711,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -298228,9 +291724,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -298262,7 +291757,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -298311,14 +291806,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -298340,7 +291832,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -298366,17 +291858,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -298392,13 +291881,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -298461,7 +291950,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -298481,7 +291970,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -298492,7 +291981,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -298539,7 +292028,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -298559,7 +292048,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -298602,7 +292091,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -298611,7 +292100,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -298629,27 +292118,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -298708,9 +292200,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -298722,7 +292212,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -298754,8 +292244,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -298790,11 +292279,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -298804,10 +292290,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -298820,17 +292303,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -298850,8 +292333,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -298877,23 +292359,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -298959,7 +292439,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -298982,7 +292462,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -299033,7 +292513,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -299048,7 +292528,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -299063,7 +292543,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -299094,7 +292574,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -299128,12 +292608,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -299145,9 +292621,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -299179,7 +292654,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -299228,14 +292703,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -299257,7 +292729,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -299283,17 +292755,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -299309,13 +292778,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -299378,7 +292847,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -299398,7 +292867,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -299409,7 +292878,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -299456,7 +292925,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -299476,7 +292945,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -299519,7 +292988,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -299528,7 +292997,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -299546,27 +293015,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -299625,9 +293097,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -299639,7 +293109,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -299671,8 +293141,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -299707,11 +293176,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -299721,10 +293187,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -299737,17 +293200,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -299767,8 +293230,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -299794,23 +293256,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -299876,7 +293336,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -299899,7 +293359,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -299950,7 +293410,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -299965,7 +293425,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -299980,7 +293440,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -300011,7 +293471,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -300045,12 +293505,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -300062,9 +293518,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -300096,7 +293551,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -300145,14 +293600,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -300174,7 +293626,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -300200,17 +293652,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -300226,13 +293675,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -300295,7 +293744,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -300315,7 +293764,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -300326,7 +293775,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -300373,7 +293822,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -300393,7 +293842,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -300436,7 +293885,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -300445,7 +293894,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -300463,27 +293912,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -300542,9 +293994,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -300556,7 +294006,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -300588,8 +294038,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -300624,11 +294073,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -300638,10 +294084,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -300654,17 +294097,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -300684,8 +294127,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -300711,23 +294153,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -300793,7 +294233,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -300816,7 +294256,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -300867,7 +294307,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -300882,7 +294322,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -300897,7 +294337,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -300928,7 +294368,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -300962,12 +294402,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -300979,9 +294415,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -301013,7 +294448,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -301062,14 +294497,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -301091,7 +294523,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -301117,17 +294549,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -301143,13 +294572,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -301212,7 +294641,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -301232,7 +294661,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -301243,7 +294672,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -301290,7 +294719,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -301310,7 +294739,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -301353,7 +294782,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -301362,7 +294791,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -301380,27 +294809,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -301459,9 +294891,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -301473,7 +294903,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -301505,8 +294935,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -301541,11 +294970,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -301555,10 +294981,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -301571,17 +294994,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -301601,8 +295024,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -301628,23 +295050,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -301710,7 +295130,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -301733,7 +295153,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -301784,7 +295204,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -301799,7 +295219,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -301814,7 +295234,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -301845,7 +295265,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -301879,12 +295299,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -301896,9 +295312,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -301930,7 +295345,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -301979,14 +295394,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -302008,7 +295420,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -302034,17 +295446,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -302060,13 +295469,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -302129,7 +295538,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -302149,7 +295558,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -302160,7 +295569,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -302207,7 +295616,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -302227,7 +295636,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -302270,7 +295679,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -302279,7 +295688,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -302297,27 +295706,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -302376,9 +295788,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -302390,7 +295800,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -302422,8 +295832,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -302458,11 +295867,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -302472,10 +295878,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -302488,17 +295891,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -302518,8 +295921,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -302545,23 +295947,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -302627,7 +296027,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -302650,7 +296050,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -302701,7 +296101,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -302716,7 +296116,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -302731,7 +296131,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -302762,7 +296162,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -302796,12 +296196,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -302813,9 +296209,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -302847,7 +296242,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -302896,14 +296291,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -302925,7 +296317,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -302951,17 +296343,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -302977,13 +296366,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -303046,7 +296435,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -303066,7 +296455,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -303077,7 +296466,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -303124,7 +296513,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -303144,7 +296533,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -303187,7 +296576,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -303196,7 +296585,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -303214,27 +296603,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -303293,9 +296685,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -303307,7 +296697,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -303339,8 +296729,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -303375,11 +296764,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -303389,10 +296775,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -303405,17 +296788,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -303435,8 +296818,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -303462,23 +296844,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -303544,7 +296924,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -303567,7 +296947,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -303618,7 +296998,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -303633,7 +297013,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -303648,7 +297028,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -303679,7 +297059,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -303713,12 +297093,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -303730,9 +297106,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -303764,7 +297139,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -303813,14 +297188,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -303842,7 +297214,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -303868,17 +297240,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -303894,13 +297263,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -303963,7 +297332,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -303983,7 +297352,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -303994,7 +297363,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -304041,7 +297410,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -304061,7 +297430,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -304104,7 +297473,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -304113,7 +297482,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -304131,27 +297500,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -304210,9 +297582,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -304224,7 +297594,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -304256,8 +297626,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -304292,11 +297661,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -304306,10 +297672,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -304322,17 +297685,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -304352,8 +297715,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -304379,23 +297741,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -304461,7 +297821,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -304484,7 +297844,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -304535,7 +297895,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -304550,7 +297910,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -304565,7 +297925,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -304596,7 +297956,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -304630,12 +297990,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -304647,9 +298003,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -304681,7 +298036,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -304730,14 +298085,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -304759,7 +298111,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -304785,17 +298137,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -304811,13 +298160,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -304880,7 +298229,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -304900,7 +298249,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -304911,7 +298260,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -304958,7 +298307,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -304978,7 +298327,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -305021,7 +298370,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -305030,7 +298379,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -305048,27 +298397,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -305127,9 +298479,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -305141,7 +298491,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -305173,8 +298523,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -305209,11 +298558,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -305223,10 +298569,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -305239,17 +298582,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -305269,8 +298612,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -305296,23 +298638,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -305378,7 +298718,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -305401,7 +298741,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -305452,7 +298792,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -305467,7 +298807,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -305482,7 +298822,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -305513,7 +298853,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -305547,12 +298887,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -305564,9 +298900,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -305598,7 +298933,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -305647,14 +298982,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -305676,7 +299008,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -305702,17 +299034,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -305728,13 +299057,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -305797,7 +299126,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -305817,7 +299146,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -305828,7 +299157,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -305875,7 +299204,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -305895,7 +299224,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -305938,7 +299267,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -305947,7 +299276,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -305965,27 +299294,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -306044,9 +299376,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -306058,7 +299388,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -306090,8 +299420,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -306126,11 +299455,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -306140,10 +299466,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -306156,17 +299479,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -306186,8 +299509,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -306213,23 +299535,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -306295,7 +299615,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -306318,7 +299638,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -306369,7 +299689,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -306384,7 +299704,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -306399,7 +299719,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -306430,7 +299750,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -306464,12 +299784,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -306481,9 +299797,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -306515,7 +299830,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -306564,14 +299879,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -306593,7 +299905,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -306619,17 +299931,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -306645,13 +299954,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -306714,7 +300023,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -306734,7 +300043,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -306745,7 +300054,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -306792,7 +300101,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -306812,7 +300121,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -306855,7 +300164,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -306864,7 +300173,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -306882,27 +300191,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -306961,9 +300273,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -306975,7 +300285,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -307007,8 +300317,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -307043,11 +300352,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -307057,10 +300363,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -307073,17 +300376,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -307103,8 +300406,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -307130,23 +300432,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -307212,7 +300512,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -307235,7 +300535,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -307286,7 +300586,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -307301,7 +300601,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -307316,7 +300616,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -307347,7 +300647,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -307381,12 +300681,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -307398,9 +300694,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -307432,7 +300727,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -307481,14 +300776,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -307510,7 +300802,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -307536,17 +300828,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -307562,13 +300851,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -307631,7 +300920,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -307651,7 +300940,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -307662,7 +300951,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -307709,7 +300998,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -307729,7 +301018,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -307772,7 +301061,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -307781,7 +301070,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -307799,27 +301088,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -307878,9 +301170,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -307892,7 +301182,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -307924,8 +301214,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -307960,11 +301249,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -307974,10 +301260,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -307990,17 +301273,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -308020,8 +301303,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -308047,23 +301329,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -308129,7 +301409,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -308152,7 +301432,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -308203,7 +301483,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -308218,7 +301498,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -308233,7 +301513,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -308264,7 +301544,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -308298,12 +301578,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -308315,9 +301591,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -308349,7 +301624,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -308398,14 +301673,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -308427,7 +301699,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -308453,17 +301725,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -308479,13 +301748,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -308548,7 +301817,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -308568,7 +301837,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -308579,7 +301848,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -308626,7 +301895,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -308646,7 +301915,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -308689,7 +301958,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -308698,7 +301967,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -308716,27 +301985,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -308795,9 +302067,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -308809,7 +302079,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -308841,8 +302111,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -308877,11 +302146,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -308891,10 +302157,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -308907,17 +302170,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -308937,8 +302200,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -308964,23 +302226,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -309046,7 +302306,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -309069,7 +302329,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -309120,7 +302380,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -309135,7 +302395,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -309150,7 +302410,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -309181,7 +302441,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -309215,12 +302475,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -309232,9 +302488,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -309266,7 +302521,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -309315,14 +302570,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -309344,7 +302596,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -309370,17 +302622,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -309396,13 +302645,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -309465,7 +302714,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -309485,7 +302734,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -309496,7 +302745,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -309543,7 +302792,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -309563,7 +302812,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -309606,7 +302855,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -309615,7 +302864,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -309633,27 +302882,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -309712,9 +302964,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -309726,7 +302976,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -309758,8 +303008,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -309794,11 +303043,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -309808,10 +303054,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -309824,17 +303067,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -309854,8 +303097,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -309881,23 +303123,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -309963,7 +303203,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -309986,7 +303226,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -310037,7 +303277,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -310052,7 +303292,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -310067,7 +303307,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -310098,7 +303338,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -310132,12 +303372,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -310149,9 +303385,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -310183,7 +303418,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -310232,14 +303467,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -310261,7 +303493,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -310287,17 +303519,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -310313,13 +303542,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -310382,7 +303611,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -310402,7 +303631,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -310413,7 +303642,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -310460,7 +303689,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -310480,7 +303709,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -310523,7 +303752,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -310532,7 +303761,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -310550,27 +303779,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -310629,9 +303861,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -310643,7 +303873,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -310675,8 +303905,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -310711,11 +303940,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -310725,10 +303951,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -310741,17 +303964,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -310771,8 +303994,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -310798,23 +304020,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -310880,7 +304100,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -310903,7 +304123,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -310954,7 +304174,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -310969,7 +304189,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -310984,7 +304204,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -311015,7 +304235,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -311049,12 +304269,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -311066,9 +304282,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -311100,7 +304315,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -311149,14 +304364,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -311178,7 +304390,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -311204,17 +304416,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -311230,13 +304439,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -311299,7 +304508,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -311319,7 +304528,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -311330,7 +304539,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -311377,7 +304586,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -311397,7 +304606,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -311440,7 +304649,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -311449,7 +304658,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -311467,27 +304676,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -311546,9 +304758,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -311560,7 +304770,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -311592,8 +304802,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -311628,11 +304837,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -311642,10 +304848,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -311658,17 +304861,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -311688,8 +304891,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -311715,23 +304917,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -311797,7 +304997,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -311820,7 +305020,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -311871,7 +305071,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -311886,7 +305086,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -311901,7 +305101,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -311932,7 +305132,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -311966,12 +305166,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -311983,9 +305179,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -312017,7 +305212,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -312066,14 +305261,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -312095,7 +305287,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -312121,17 +305313,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -312147,13 +305336,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -312216,7 +305405,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -312236,7 +305425,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -312247,7 +305436,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -312294,7 +305483,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -312314,7 +305503,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -312357,7 +305546,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -312366,7 +305555,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -312384,27 +305573,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -312463,9 +305655,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -312477,7 +305667,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -312509,8 +305699,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -312545,11 +305734,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -312559,10 +305745,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -312575,17 +305758,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -312605,8 +305788,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -312632,23 +305814,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -312714,7 +305894,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -312737,7 +305917,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -312788,7 +305968,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -312803,7 +305983,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -312818,7 +305998,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -312849,7 +306029,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -312883,12 +306063,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -312900,9 +306076,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -312934,7 +306109,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -312983,14 +306158,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -313012,7 +306184,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -313038,17 +306210,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -313064,13 +306233,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -313133,7 +306302,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -313153,7 +306322,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -313164,7 +306333,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -313211,7 +306380,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -313231,7 +306400,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -313274,7 +306443,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -313283,7 +306452,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -313301,27 +306470,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -313380,9 +306552,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -313394,7 +306564,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -313426,8 +306596,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -313462,11 +306631,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -313476,10 +306642,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -313492,17 +306655,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -313522,8 +306685,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -313549,23 +306711,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -313631,7 +306791,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -313654,7 +306814,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -313705,7 +306865,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -313720,7 +306880,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -313735,7 +306895,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -313766,7 +306926,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -313800,12 +306960,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -313817,9 +306973,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -313851,7 +307006,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -313900,14 +307055,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -313929,7 +307081,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -313955,17 +307107,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -313981,13 +307130,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -314050,7 +307199,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -314070,7 +307219,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -314081,7 +307230,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -314128,7 +307277,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -314148,7 +307297,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -314191,7 +307340,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -314200,7 +307349,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -314218,27 +307367,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -314297,9 +307449,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -314311,7 +307461,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -314343,8 +307493,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -314379,11 +307528,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -314393,10 +307539,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -314409,17 +307552,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -314439,8 +307582,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -314466,23 +307608,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -314548,7 +307688,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -314571,7 +307711,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -314622,7 +307762,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -314637,7 +307777,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -314652,7 +307792,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -314683,7 +307823,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -314717,12 +307857,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -314734,9 +307870,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -314768,7 +307903,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -314817,14 +307952,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -314846,7 +307978,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -314872,17 +308004,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -314898,13 +308027,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -314967,7 +308096,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -314987,7 +308116,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -314998,7 +308127,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -315045,7 +308174,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -315065,7 +308194,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -315108,7 +308237,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -315117,7 +308246,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -315135,27 +308264,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -315214,9 +308346,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -315228,7 +308358,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -315260,8 +308390,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -315296,11 +308425,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -315310,10 +308436,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -315326,17 +308449,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -315356,8 +308479,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -315383,23 +308505,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -315465,7 +308585,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -315488,7 +308608,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -315539,7 +308659,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -315554,7 +308674,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -315569,7 +308689,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -315600,7 +308720,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -315634,12 +308754,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -315651,9 +308767,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -315685,7 +308800,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -315734,14 +308849,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -315763,7 +308875,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -315789,17 +308901,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -315815,13 +308924,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -315884,7 +308993,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -315904,7 +309013,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -315915,7 +309024,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -315962,7 +309071,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -315982,7 +309091,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -316025,7 +309134,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -316034,7 +309143,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -316052,27 +309161,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -316131,9 +309243,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -316145,7 +309255,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -316177,8 +309287,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -316213,11 +309322,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -316227,10 +309333,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -316243,17 +309346,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -316273,8 +309376,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -316300,23 +309402,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -316382,7 +309482,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -316405,7 +309505,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -316456,7 +309556,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -316471,7 +309571,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -316486,7 +309586,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -316517,7 +309617,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -316551,12 +309651,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -316568,9 +309664,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -316602,7 +309697,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -316651,14 +309746,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -316680,7 +309772,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -316706,17 +309798,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -316732,13 +309821,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -316801,7 +309890,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -316821,7 +309910,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -316832,7 +309921,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -316879,7 +309968,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -316899,7 +309988,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -316942,7 +310031,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -316951,7 +310040,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -316969,27 +310058,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -317048,9 +310140,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -317062,7 +310152,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -317094,8 +310184,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -317130,11 +310219,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -317144,10 +310230,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -317160,17 +310243,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -317190,8 +310273,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -317217,23 +310299,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -317299,7 +310379,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -317322,7 +310402,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -317373,7 +310453,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -317388,7 +310468,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -317403,7 +310483,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -317434,7 +310514,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -317468,12 +310548,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -317485,9 +310561,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -317519,7 +310594,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -317568,14 +310643,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -317597,7 +310669,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -317623,17 +310695,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -317649,13 +310718,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -317718,7 +310787,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -317738,7 +310807,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -317749,7 +310818,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -317796,7 +310865,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -317816,7 +310885,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -317859,7 +310928,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -317868,7 +310937,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -317886,27 +310955,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -317965,9 +311037,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -317979,7 +311049,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -318011,8 +311081,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -318047,11 +311116,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -318061,10 +311127,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -318077,17 +311140,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -318107,8 +311170,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -318134,23 +311196,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -318216,7 +311276,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -318239,7 +311299,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -318290,7 +311350,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -318305,7 +311365,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -318320,7 +311380,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -318351,7 +311411,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -318385,12 +311445,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -318402,9 +311458,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -318436,7 +311491,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -318485,14 +311540,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -318514,7 +311566,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -318540,17 +311592,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -318566,13 +311615,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -318635,7 +311684,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -318655,7 +311704,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -318666,7 +311715,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -318713,7 +311762,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -318733,7 +311782,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -318776,7 +311825,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -318785,7 +311834,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -318803,27 +311852,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -318882,9 +311934,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -318896,7 +311946,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -318928,8 +311978,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -318964,11 +312013,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -318978,10 +312024,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -318994,17 +312037,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -319024,8 +312067,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -319051,23 +312093,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -319133,7 +312173,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -319156,7 +312196,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -319207,7 +312247,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -319222,7 +312262,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -319237,7 +312277,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -319268,7 +312308,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -319302,12 +312342,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -319319,9 +312355,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -319353,7 +312388,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -319402,14 +312437,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -319431,7 +312463,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -319457,17 +312489,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -319483,13 +312512,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -319552,7 +312581,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -319572,7 +312601,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -319583,7 +312612,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -319630,7 +312659,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -319650,7 +312679,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -319693,7 +312722,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -319702,7 +312731,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -319720,27 +312749,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -319799,9 +312831,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -319813,7 +312843,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -319845,8 +312875,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -319881,11 +312910,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -319895,10 +312921,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -319911,17 +312934,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -319941,8 +312964,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -319968,23 +312990,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -320050,7 +313070,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -320073,7 +313093,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -320124,7 +313144,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -320139,7 +313159,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -320154,7 +313174,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -320185,7 +313205,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -320219,12 +313239,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -320236,9 +313252,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -320270,7 +313285,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -320319,14 +313334,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -320348,7 +313360,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -320374,17 +313386,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -320400,13 +313409,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -320469,7 +313478,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -320489,7 +313498,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -320500,7 +313509,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -320547,7 +313556,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -320567,7 +313576,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -320610,7 +313619,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -320619,7 +313628,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -320637,27 +313646,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -320716,9 +313728,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -320730,7 +313740,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -320762,8 +313772,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -320798,11 +313807,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -320812,10 +313818,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -320828,17 +313831,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -320858,8 +313861,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -320885,23 +313887,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -320967,7 +313967,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -320990,7 +313990,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -321041,7 +314041,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -321056,7 +314056,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -321071,7 +314071,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -321102,7 +314102,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -321136,12 +314136,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -321153,9 +314149,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -321187,7 +314182,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -321236,14 +314231,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -321265,7 +314257,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -321291,17 +314283,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -321317,13 +314306,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -321386,7 +314375,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -321406,7 +314395,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -321417,7 +314406,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -321464,7 +314453,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -321484,7 +314473,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -321527,7 +314516,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -321536,7 +314525,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -321554,27 +314543,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -321633,9 +314625,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -321647,7 +314637,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -321679,8 +314669,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -321715,11 +314704,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -321729,10 +314715,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -321745,17 +314728,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -321775,8 +314758,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -321802,23 +314784,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 @@ -321884,7 +314864,7 @@ T1156,No,-,0 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1067,No,-,0 T1037,No,-,0 -T1557,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,3 +T1557,No,-,0 T1033,No,-,0 T1583,No,-,0 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,8 @@ -321907,7 +314887,7 @@ T1592,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1596.003,No,-,0 T1056.001,No,-,0 T1222.002,No,-,0 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,1 +T1110.001,No,-,0 T1216.001,No,-,0 T1597.002,No,-,0 T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,28 @@ -321958,7 +314938,7 @@ T1548.003,No,-,0 T1560.003,No,-,0 T1578,No,-,0 T1069,No,-,0 -T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,5 +T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4 T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,1 T1596.002,No,-,0 T1542.001,No,-,0 @@ -321973,7 +314953,7 @@ T1588.004,No,-,0 T1583.002,No,-,0 T1561,No,-,0 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,2 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,2 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,2 T1552.005,No,-,0 T1555.002,No,-,0 T1542.003,No,-,0 @@ -321988,7 +314968,7 @@ T1587.003,No,-,0 T1565.001,No,-,0 T1110.002,No,-,0 T1178,No,-,0 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,0 T1555.001,No,-,0 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,5 T1547,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,5 @@ -322019,7 +314999,7 @@ T1167,No,-,0 T1586.001,No,-,0 T1527,No,-,0 T1180,No,-,0 -T1542.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml,1 +T1542.005,No,-,0 T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,1 T1568.001,No,-,0 T1497.001,No,-,0 @@ -322053,12 +315033,8 @@ T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1040,No,-,0 T1017,No,-,0 T1553.002,No,-,0 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml,6 -T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml,6 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,2 +T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,2 T1565.003,No,-,0 T1552.002,No,-,0 T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3 @@ -322070,9 +315046,8 @@ T1587.002,No,-,0 T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,1 T1137.006,No,-,0 T1505.002,No,-,0 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,2 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,2 -T1071,No,-,5 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1 +T1071,No,-,3 T1074.002,No,-,0 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9 T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,9 @@ -322104,7 +315079,7 @@ T1137.005,No,-,0 T1562,No,-,9 T1586.002,No,-,0 T1195,No,-,0 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,1 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,4 T1558,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,4 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3 @@ -322153,14 +315128,11 @@ T1218.003,No,-,0 T1563.001,No,-,0 T1562.002,No,-,0 T1029,No,-,0 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,6 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,6 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml,2 -T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,2 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4 +T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1 T1572,No,-,0 T1218.002,No,-,0 T1599.001,No,-,0 @@ -322182,7 +315154,7 @@ T1152,No,-,0 T1553.003,No,-,0 T1483,No,-,0 T1185,No,-,0 -T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,9 +T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5 T1071.003,No,-,0 T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1 T1596,No,-,0 @@ -322208,17 +315180,14 @@ T1535,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2 T1155,No,-,0 T1563,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,1 T1027.001,No,-,0 -T1505.003,No,-,0 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,1 T1484.001,No,-,0 T1217,No,-,0 T1552.004,No,-,0 T1583.004,No,-,0 T1021.006,No,-,0 T1011.001,No,-,0 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml,4 -T1078.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml,4 +T1078.001,No,-,0 T1547.003,No,-,0 T1183,No,-,0 T1085,No,-,0 @@ -322234,13 +315203,13 @@ T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1585.002,No,-,0 T1557.001,No,-,0 T1222,No,-,1 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,10 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,10 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,10 @@ -322303,7 +315272,7 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 T1558.001,No,-,0 T1175,No,-,0 -T1020,No,-,1 +T1020,No,-,0 T1592.004,No,-,0 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4 T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4 @@ -322323,7 +315292,7 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1568,No,-,0 T1036.004,No,-,0 T1055.004,No,-,0 -T1020.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,1 +T1020.001,No,-,0 T1138,No,-,0 T1546.009,No,-,0 T1191,No,-,0 @@ -322334,7 +315303,7 @@ T1074,No,-,0 T1049,No,-,0 T1584,No,-,0 T1600.002,No,-,0 -T1542,No,-,1 +T1542,No,-,0 T1064,No,-,0 T1051,No,-,0 T1055.002,No,-,0 @@ -322381,7 +315350,7 @@ T1596.004,No,-,0 T1497.002,No,-,0 T1141,No,-,0 T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,1 +T1041,No,-,0 T1134.004,No,-,0 T1591,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,1 T1060,No,-,0 @@ -322401,7 +315370,7 @@ T1023,No,-,0 T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,1 T1055.014,No,-,0 T1026,No,-,0 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,1 +T1071.002,No,-,0 T1122,No,-,0 T1015,No,-,0 T1212,No,-,0 @@ -322444,7 +315413,7 @@ T1588.002,No,-,0 T1052.001,No,-,0 T1597,No,-,0 T1053.006,No,-,0 -T1566,No,-,2 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,3 T1061,No,-,0 T1542.004,No,-,0 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,4 @@ -322453,7 +315422,7 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4 T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1 T1090.003,No,-,0 -T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2 +T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,1 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 @@ -322471,27 +315440,30 @@ T1601,No,-,0 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,4 T1574,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,4 T1027.005,No,-,0 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,45 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,45 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,42 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,42 T1571,No,-,0 T1585.001,No,-,0 T1073,No,-,0 @@ -322550,9 +315522,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,6 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,6 T1102.002,No,-,0 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,3 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,3 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,1 T1137.004,No,-,0 T1573.002,No,-,0 T1567.002,No,-,0 @@ -322564,7 +315534,7 @@ T1037.005,No,-,0 T1100,No,-,0 T1186,No,-,0 T1184,No,-,0 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,1 +T1095,No,-,0 T1075,No,-,0 T1027.003,No,-,0 T1584.002,No,-,0 @@ -322596,8 +315566,7 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1088,No,-,0 T1494,No,-,0 T1090.004,No,-,0 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,2 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,2 +T1557.002,No,-,0 T1562.008,No,-,0 T1518.001,No,-,0 T1564.003,No,-,0 @@ -322632,11 +315601,8 @@ T1213,No,-,0 T1146,No,-,0 T1519,No,-,0 T1194,No,-,0 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 -T1505,No,-,0 +T1200,No,-,0 +T1505,No,-,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,2 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,2 T1132.002,No,-,0 @@ -322646,10 +315612,7 @@ T1130,No,-,0 T1022,No,-,0 T1070.004,No,-,0 T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,4 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,4 +T1498,No,-,0 T1595.001,No,-,0 T1158,No,-,0 T1221,No,-,0 @@ -322662,17 +315625,17 @@ T1209,No,-,0 T1111,No,-,0 T1159,No,-,0 T1027.002,No,-,0 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,2 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,2 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,1 T1059.005,No,-,0 T1564.005,No,-,0 T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,7 T1584.004,No,-,0 -T1526,No,-,0 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 T1151,No,-,0 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,1 +T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,2 T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1 @@ -322692,8 +315655,7 @@ T1126,No,-,0 T1084,No,-,0 T1160,No,-,0 T1055.008,No,-,0 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,2 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,2 +T1021.001,No,-,0 T1037.001,No,-,0 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,4 T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,4 @@ -322719,23 +315681,21 @@ T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 T1569.002,No,-,0 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,17 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,17 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,15 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,15 T1480.001,No,-,0 T1008,No,-,0 T1564.004,No,-,0 diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json index 2864eec072..f06fce047f 100644 --- a/docs/mitre-map/coverage.json +++ b/docs/mitre-map/coverage.json @@ -26,11 +26,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -53,11 +49,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -111,7 +103,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -138,7 +130,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -154,11 +146,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -197,11 +185,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -248,8 +232,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -270,8 +254,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -320,7 +304,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -385,13 +369,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -419,7 +403,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -458,6 +442,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -465,11 +454,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -493,7 +477,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -608,11 +592,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -683,11 +663,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -714,11 +690,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -771,7 +743,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -787,7 +763,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -816,8 +792,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -897,8 +873,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -915,11 +891,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -963,11 +935,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -1009,11 +977,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -1031,11 +995,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -1051,8 +1011,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -1064,13 +1024,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -1104,11 +1064,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -1140,8 +1096,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -1232,11 +1188,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -1259,11 +1211,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -1317,7 +1265,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -1344,7 +1292,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -1360,11 +1308,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -1403,11 +1347,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -1454,8 +1394,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -1476,8 +1416,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -1526,7 +1466,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -1591,13 +1531,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -1625,7 +1565,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -1664,6 +1604,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -1671,11 +1616,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -1699,7 +1639,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -1814,11 +1754,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -1889,11 +1825,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -1920,11 +1852,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -1977,7 +1905,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -1993,7 +1925,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -2022,8 +1954,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -2103,8 +2035,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -2121,11 +2053,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -2169,11 +2097,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -2215,11 +2139,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -2237,11 +2157,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -2257,8 +2173,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -2270,13 +2186,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -2310,11 +2226,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -2346,8 +2258,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -2438,11 +2350,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -2465,11 +2373,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -2523,7 +2427,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -2550,7 +2454,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -2566,11 +2470,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -2609,11 +2509,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -2660,8 +2556,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -2682,8 +2578,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -2732,7 +2628,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -2797,13 +2693,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -2831,7 +2727,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -2870,6 +2766,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -2877,11 +2778,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -2905,7 +2801,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -3020,11 +2916,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -3095,11 +2987,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -3126,11 +3014,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -3183,7 +3067,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -3199,7 +3087,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -3228,8 +3116,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -3309,8 +3197,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -3327,11 +3215,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -3375,11 +3259,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -3421,11 +3301,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -3443,11 +3319,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -3463,8 +3335,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -3476,13 +3348,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -3516,11 +3388,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -3552,8 +3420,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -3644,11 +3512,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -3671,11 +3535,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -3729,7 +3589,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -3756,7 +3616,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -3772,11 +3632,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -3815,11 +3671,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -3866,8 +3718,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -3888,8 +3740,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -3938,7 +3790,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -4003,13 +3855,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -4037,7 +3889,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -4076,6 +3928,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -4083,11 +3940,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -4111,7 +3963,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -4226,11 +4078,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -4301,11 +4149,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -4332,11 +4176,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -4389,7 +4229,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -4405,7 +4249,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -4434,8 +4278,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -4515,8 +4359,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -4533,11 +4377,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -4581,11 +4421,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -4627,11 +4463,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -4649,11 +4481,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -4669,8 +4497,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -4682,13 +4510,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -4722,11 +4550,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -4758,8 +4582,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -4850,11 +4674,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -4877,11 +4697,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -4935,7 +4751,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -4962,7 +4778,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -4978,11 +4794,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -5021,11 +4833,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -5072,8 +4880,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -5094,8 +4902,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -5144,7 +4952,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -5209,13 +5017,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -5243,7 +5051,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -5282,6 +5090,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -5289,11 +5102,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -5317,7 +5125,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -5432,11 +5240,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -5507,11 +5311,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -5538,11 +5338,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -5595,7 +5391,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -5611,7 +5411,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -5640,8 +5440,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -5721,8 +5521,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -5739,11 +5539,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -5787,11 +5583,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -5833,11 +5625,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -5855,11 +5643,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -5875,8 +5659,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -5888,13 +5672,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -5928,11 +5712,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -5964,8 +5744,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -6056,11 +5836,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -6083,11 +5859,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -6141,7 +5913,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -6168,7 +5940,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -6184,11 +5956,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -6227,11 +5995,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -6278,8 +6042,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -6300,8 +6064,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -6350,7 +6114,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -6415,13 +6179,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -6449,7 +6213,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -6488,6 +6252,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -6495,11 +6264,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -6523,7 +6287,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -6638,11 +6402,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -6713,11 +6473,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -6744,11 +6500,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -6801,7 +6553,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -6817,7 +6573,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -6846,8 +6602,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -6927,8 +6683,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -6945,11 +6701,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -6993,11 +6745,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -7039,11 +6787,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -7061,11 +6805,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -7081,8 +6821,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -7094,13 +6834,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -7134,11 +6874,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -7170,8 +6906,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -7262,11 +6998,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -7289,11 +7021,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -7347,7 +7075,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -7374,7 +7102,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -7390,11 +7118,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -7433,11 +7157,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -7484,8 +7204,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -7506,8 +7226,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -7556,7 +7276,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -7621,13 +7341,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -7655,7 +7375,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -7694,6 +7414,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -7701,11 +7426,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -7729,7 +7449,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -7844,11 +7564,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -7919,11 +7635,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -7950,11 +7662,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -8007,7 +7715,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -8023,7 +7735,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -8052,8 +7764,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -8133,8 +7845,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -8151,11 +7863,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -8199,11 +7907,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -8245,11 +7949,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -8267,11 +7967,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -8287,8 +7983,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -8300,13 +7996,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -8340,11 +8036,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -8376,8 +8068,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -8468,11 +8160,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -8495,11 +8183,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -8553,7 +8237,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -8580,7 +8264,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -8596,11 +8280,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -8639,11 +8319,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -8690,8 +8366,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -8712,8 +8388,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -8762,7 +8438,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -8827,13 +8503,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -8861,7 +8537,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -8900,6 +8576,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -8907,11 +8588,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -8935,7 +8611,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -9050,11 +8726,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -9125,11 +8797,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -9156,11 +8824,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -9213,7 +8877,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -9229,7 +8897,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -9258,8 +8926,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -9339,8 +9007,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -9357,11 +9025,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -9405,11 +9069,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -9451,11 +9111,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -9473,11 +9129,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -9493,8 +9145,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -9506,13 +9158,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -9546,11 +9198,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -9582,8 +9230,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -9674,11 +9322,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -9701,11 +9345,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -9759,7 +9399,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -9786,7 +9426,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -9802,11 +9442,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -9845,11 +9481,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -9896,8 +9528,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -9918,8 +9550,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -9968,7 +9600,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -10033,13 +9665,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -10067,7 +9699,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -10106,6 +9738,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -10113,11 +9750,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -10141,7 +9773,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -10256,11 +9888,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -10331,11 +9959,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -10362,11 +9986,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -10419,7 +10039,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -10435,7 +10059,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -10464,8 +10088,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -10545,8 +10169,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -10563,11 +10187,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -10611,11 +10231,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -10657,11 +10273,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -10679,11 +10291,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -10699,8 +10307,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -10712,13 +10320,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -10752,11 +10360,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -10788,8 +10392,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -10880,11 +10484,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -10907,11 +10507,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -10965,7 +10561,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -10992,7 +10588,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -11008,11 +10604,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -11051,11 +10643,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -11102,8 +10690,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -11124,8 +10712,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -11174,7 +10762,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -11239,13 +10827,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -11273,7 +10861,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -11312,6 +10900,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -11319,11 +10912,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -11347,7 +10935,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -11462,11 +11050,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -11537,11 +11121,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -11568,11 +11148,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -11625,7 +11201,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -11641,7 +11221,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -11670,8 +11250,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -11751,8 +11331,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -11769,11 +11349,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -11817,11 +11393,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -11863,11 +11435,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -11885,11 +11453,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -11905,8 +11469,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -11918,13 +11482,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -11958,11 +11522,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -11994,8 +11554,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -12086,11 +11646,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -12113,11 +11669,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -12171,7 +11723,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -12198,7 +11750,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -12214,11 +11766,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -12257,11 +11805,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -12308,8 +11852,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -12330,8 +11874,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -12380,7 +11924,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -12445,13 +11989,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -12479,7 +12023,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -12518,6 +12062,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -12525,11 +12074,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -12553,7 +12097,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -12668,11 +12212,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -12743,11 +12283,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -12774,11 +12310,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -12831,7 +12363,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -12847,7 +12383,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -12876,8 +12412,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -12957,8 +12493,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -12975,11 +12511,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -13023,11 +12555,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -13069,11 +12597,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -13091,11 +12615,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -13111,8 +12631,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -13124,13 +12644,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -13164,11 +12684,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -13200,8 +12716,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -13292,11 +12808,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -13319,11 +12831,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -13377,7 +12885,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -13404,7 +12912,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -13420,11 +12928,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -13463,11 +12967,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -13514,8 +13014,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -13536,8 +13036,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -13586,7 +13086,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -13651,13 +13151,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -13685,7 +13185,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -13724,6 +13224,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -13731,11 +13236,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -13759,7 +13259,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -13874,11 +13374,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -13949,11 +13445,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -13980,11 +13472,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -14037,7 +13525,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -14053,7 +13545,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -14082,8 +13574,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -14163,8 +13655,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -14181,11 +13673,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -14229,11 +13717,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -14275,11 +13759,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -14297,11 +13777,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -14317,8 +13793,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -14330,13 +13806,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -14370,11 +13846,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -14406,8 +13878,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -14498,11 +13970,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -14525,11 +13993,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -14583,7 +14047,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -14610,7 +14074,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -14626,11 +14090,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -14669,11 +14129,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -14720,8 +14176,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -14742,8 +14198,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -14792,7 +14248,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -14857,13 +14313,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -14891,7 +14347,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -14930,6 +14386,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -14937,11 +14398,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -14965,7 +14421,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -15080,11 +14536,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -15155,11 +14607,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -15186,11 +14634,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -15243,7 +14687,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -15259,7 +14707,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -15288,8 +14736,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -15369,8 +14817,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -15387,11 +14835,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -15435,11 +14879,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -15481,11 +14921,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -15503,11 +14939,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -15523,8 +14955,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -15536,13 +14968,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -15576,11 +15008,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -15612,8 +15040,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -15704,11 +15132,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -15731,11 +15155,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -15789,7 +15209,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -15816,7 +15236,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -15832,11 +15252,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -15875,11 +15291,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -15926,8 +15338,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -15948,8 +15360,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -15998,7 +15410,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -16063,13 +15475,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -16097,7 +15509,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -16136,6 +15548,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -16143,11 +15560,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -16171,7 +15583,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -16286,11 +15698,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -16361,11 +15769,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -16392,11 +15796,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -16449,7 +15849,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -16465,7 +15869,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -16494,8 +15898,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -16575,8 +15979,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -16593,11 +15997,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -16641,11 +16041,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -16687,11 +16083,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -16709,11 +16101,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -16729,8 +16117,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -16742,13 +16130,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -16782,11 +16170,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -16818,8 +16202,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -16910,11 +16294,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -16937,11 +16317,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -16995,7 +16371,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -17022,7 +16398,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -17038,11 +16414,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -17081,11 +16453,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -17132,8 +16500,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -17154,8 +16522,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -17204,7 +16572,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -17269,13 +16637,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -17303,7 +16671,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -17342,6 +16710,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -17349,11 +16722,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -17377,7 +16745,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -17492,11 +16860,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -17567,11 +16931,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -17598,11 +16958,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -17655,7 +17011,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -17671,7 +17031,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -17700,8 +17060,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -17781,8 +17141,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -17799,11 +17159,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -17847,11 +17203,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -17893,11 +17245,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -17915,11 +17263,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -17935,8 +17279,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -17948,13 +17292,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -17988,11 +17332,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -18024,8 +17364,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -18116,11 +17456,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -18143,11 +17479,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -18201,7 +17533,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -18228,7 +17560,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -18244,11 +17576,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -18287,11 +17615,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -18338,8 +17662,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -18360,8 +17684,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -18410,7 +17734,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -18475,13 +17799,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -18509,7 +17833,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -18548,6 +17872,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -18555,11 +17884,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -18583,7 +17907,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -18698,11 +18022,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -18773,11 +18093,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -18804,11 +18120,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -18861,7 +18173,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -18877,7 +18193,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -18906,8 +18222,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -18987,8 +18303,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -19005,11 +18321,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -19053,11 +18365,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -19099,11 +18407,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -19121,11 +18425,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -19141,8 +18441,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -19154,13 +18454,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -19194,11 +18494,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -19230,8 +18526,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -19322,11 +18618,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -19349,11 +18641,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -19407,7 +18695,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -19434,7 +18722,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -19450,11 +18738,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -19493,11 +18777,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -19544,8 +18824,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -19566,8 +18846,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -19616,7 +18896,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -19681,13 +18961,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -19715,7 +18995,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -19754,6 +19034,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -19761,11 +19046,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -19789,7 +19069,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -19904,11 +19184,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -19979,11 +19255,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -20010,11 +19282,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -20067,7 +19335,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -20083,7 +19355,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -20112,8 +19384,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -20193,8 +19465,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -20211,11 +19483,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -20259,11 +19527,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -20305,11 +19569,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -20327,11 +19587,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -20347,8 +19603,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -20360,13 +19616,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -20400,11 +19656,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -20436,8 +19688,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -20528,11 +19780,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -20555,11 +19803,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -20613,7 +19857,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -20640,7 +19884,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -20656,11 +19900,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -20699,11 +19939,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -20750,8 +19986,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -20772,8 +20008,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -20822,7 +20058,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -20887,13 +20123,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -20921,7 +20157,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -20960,6 +20196,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -20967,11 +20208,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -20995,7 +20231,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -21110,11 +20346,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -21185,11 +20417,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -21216,11 +20444,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -21273,7 +20497,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -21289,7 +20517,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -21318,8 +20546,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -21399,8 +20627,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -21417,11 +20645,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -21465,11 +20689,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -21511,11 +20731,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -21533,11 +20749,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -21553,8 +20765,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -21566,13 +20778,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -21606,11 +20818,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -21642,8 +20850,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -21734,11 +20942,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -21761,11 +20965,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -21819,7 +21019,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -21846,7 +21046,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -21862,11 +21062,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -21905,11 +21101,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -21956,8 +21148,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -21978,8 +21170,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -22028,7 +21220,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -22093,13 +21285,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -22127,7 +21319,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -22166,6 +21358,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -22173,11 +21370,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -22201,7 +21393,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -22316,11 +21508,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -22391,11 +21579,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -22422,11 +21606,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -22479,7 +21659,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -22495,7 +21679,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -22524,8 +21708,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -22605,8 +21789,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -22623,11 +21807,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -22671,11 +21851,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -22717,11 +21893,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -22739,11 +21911,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -22759,8 +21927,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -22772,13 +21940,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -22812,11 +21980,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -22848,8 +22012,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -22940,11 +22104,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -22967,11 +22127,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -23025,7 +22181,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -23052,7 +22208,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -23068,11 +22224,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -23111,11 +22263,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -23162,8 +22310,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -23184,8 +22332,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -23234,7 +22382,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -23299,13 +22447,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -23333,7 +22481,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -23372,6 +22520,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -23379,11 +22532,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -23407,7 +22555,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -23522,11 +22670,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -23597,11 +22741,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -23628,11 +22768,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -23685,7 +22821,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -23701,7 +22841,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -23730,8 +22870,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -23811,8 +22951,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -23829,11 +22969,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -23877,11 +23013,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -23923,11 +23055,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -23945,11 +23073,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -23965,8 +23089,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -23978,13 +23102,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -24018,11 +23142,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -24054,8 +23174,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -24146,11 +23266,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -24173,11 +23289,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -24231,7 +23343,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -24258,7 +23370,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -24274,11 +23386,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -24317,11 +23425,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -24368,8 +23472,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -24390,8 +23494,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -24440,7 +23544,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -24505,13 +23609,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -24539,7 +23643,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -24578,6 +23682,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -24585,11 +23694,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -24613,7 +23717,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -24728,11 +23832,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -24803,11 +23903,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -24834,11 +23930,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -24891,7 +23983,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -24907,7 +24003,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -24936,8 +24032,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -25017,8 +24113,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -25035,11 +24131,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -25083,11 +24175,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -25129,11 +24217,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -25151,11 +24235,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -25171,8 +24251,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -25184,13 +24264,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -25224,11 +24304,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -25260,8 +24336,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -25352,11 +24428,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -25379,11 +24451,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -25437,7 +24505,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -25464,7 +24532,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -25480,11 +24548,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -25523,11 +24587,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -25574,8 +24634,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -25596,8 +24656,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -25646,7 +24706,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -25711,13 +24771,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -25745,7 +24805,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -25784,6 +24844,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -25791,11 +24856,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -25819,7 +24879,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -25934,11 +24994,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -26009,11 +25065,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -26040,11 +25092,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -26097,7 +25145,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -26113,7 +25165,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -26142,8 +25194,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -26223,8 +25275,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -26241,11 +25293,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -26289,11 +25337,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -26335,11 +25379,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -26357,11 +25397,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -26377,8 +25413,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -26390,13 +25426,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -26430,11 +25466,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -26466,8 +25498,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -26558,11 +25590,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -26585,11 +25613,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -26643,7 +25667,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -26670,7 +25694,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -26686,11 +25710,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -26729,11 +25749,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -26780,8 +25796,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -26802,8 +25818,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -26852,7 +25868,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -26917,13 +25933,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -26951,7 +25967,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -26990,6 +26006,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -26997,11 +26018,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -27025,7 +26041,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -27140,11 +26156,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -27215,11 +26227,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -27246,11 +26254,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -27303,7 +26307,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -27319,7 +26327,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -27348,8 +26356,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -27429,8 +26437,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -27447,11 +26455,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -27495,11 +26499,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -27541,11 +26541,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -27563,11 +26559,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -27583,8 +26575,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -27596,13 +26588,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -27636,11 +26628,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -27672,8 +26660,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -27764,11 +26752,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -27791,11 +26775,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -27849,7 +26829,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -27876,7 +26856,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -27892,11 +26872,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -27935,11 +26911,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -27986,8 +26958,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -28008,8 +26980,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -28058,7 +27030,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -28123,13 +27095,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -28157,7 +27129,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -28196,6 +27168,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -28203,11 +27180,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -28231,7 +27203,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -28346,11 +27318,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -28421,11 +27389,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -28452,11 +27416,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -28509,7 +27469,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -28525,7 +27489,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -28554,8 +27518,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -28635,8 +27599,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -28653,11 +27617,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -28701,11 +27661,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -28747,11 +27703,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -28769,11 +27721,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -28789,8 +27737,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -28802,13 +27750,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -28842,11 +27790,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -28878,8 +27822,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -28970,11 +27914,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -28997,11 +27937,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -29055,7 +27991,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -29082,7 +28018,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -29098,11 +28034,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -29141,11 +28073,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -29192,8 +28120,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -29214,8 +28142,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -29264,7 +28192,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -29329,13 +28257,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -29363,7 +28291,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -29402,6 +28330,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -29409,11 +28342,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -29437,7 +28365,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -29552,11 +28480,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -29627,11 +28551,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -29658,11 +28578,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -29715,7 +28631,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -29731,7 +28651,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -29760,8 +28680,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -29841,8 +28761,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -29859,11 +28779,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -29907,11 +28823,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -29953,11 +28865,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -29975,11 +28883,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -29995,8 +28899,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -30008,13 +28912,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -30048,11 +28952,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -30084,8 +28984,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -30176,11 +29076,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -30203,11 +29099,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -30261,7 +29153,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -30288,7 +29180,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -30304,11 +29196,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -30347,11 +29235,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -30398,8 +29282,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -30420,8 +29304,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -30470,7 +29354,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -30535,13 +29419,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -30569,7 +29453,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -30608,6 +29492,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -30615,11 +29504,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -30643,7 +29527,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -30758,11 +29642,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -30833,11 +29713,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -30864,11 +29740,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -30921,7 +29793,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -30937,7 +29813,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -30966,8 +29842,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -31047,8 +29923,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -31065,11 +29941,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -31113,11 +29985,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -31159,11 +30027,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -31181,11 +30045,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -31201,8 +30061,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -31214,13 +30074,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -31254,11 +30114,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -31290,8 +30146,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -31382,11 +30238,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -31409,11 +30261,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -31467,7 +30315,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -31494,7 +30342,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -31510,11 +30358,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -31553,11 +30397,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -31604,8 +30444,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -31626,8 +30466,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -31676,7 +30516,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -31741,13 +30581,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -31775,7 +30615,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -31814,6 +30654,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -31821,11 +30666,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -31849,7 +30689,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -31964,11 +30804,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -32039,11 +30875,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -32070,11 +30902,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -32127,7 +30955,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -32143,7 +30975,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -32172,8 +31004,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -32253,8 +31085,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -32271,11 +31103,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -32319,11 +31147,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -32365,11 +31189,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -32387,11 +31207,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -32407,8 +31223,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -32420,13 +31236,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -32460,11 +31276,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -32496,8 +31308,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -32588,11 +31400,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -32615,11 +31423,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -32673,7 +31477,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -32700,7 +31504,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -32716,11 +31520,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -32759,11 +31559,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -32810,8 +31606,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -32832,8 +31628,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -32882,7 +31678,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -32947,13 +31743,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -32981,7 +31777,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -33020,6 +31816,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -33027,11 +31828,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -33055,7 +31851,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -33170,11 +31966,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -33245,11 +32037,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -33276,11 +32064,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -33333,7 +32117,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -33349,7 +32137,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -33378,8 +32166,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -33459,8 +32247,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -33477,11 +32265,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -33525,11 +32309,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -33571,11 +32351,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -33593,11 +32369,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -33613,8 +32385,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -33626,13 +32398,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -33666,11 +32438,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -33702,8 +32470,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -33794,11 +32562,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -33821,11 +32585,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -33879,7 +32639,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -33906,7 +32666,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -33922,11 +32682,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -33965,11 +32721,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -34016,8 +32768,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -34038,8 +32790,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -34088,7 +32840,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -34153,13 +32905,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -34187,7 +32939,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -34226,6 +32978,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -34233,11 +32990,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -34261,7 +33013,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -34376,11 +33128,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -34451,11 +33199,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -34482,11 +33226,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -34539,7 +33279,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -34555,7 +33299,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -34584,8 +33328,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -34665,8 +33409,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -34683,11 +33427,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -34731,11 +33471,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -34777,11 +33513,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -34799,11 +33531,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -34819,8 +33547,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -34832,13 +33560,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -34872,11 +33600,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -34908,8 +33632,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -35000,11 +33724,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -35027,11 +33747,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -35085,7 +33801,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -35112,7 +33828,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -35128,11 +33844,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -35171,11 +33883,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -35222,8 +33930,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -35244,8 +33952,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -35294,7 +34002,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -35359,13 +34067,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -35393,7 +34101,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -35432,6 +34140,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -35439,11 +34152,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -35467,7 +34175,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -35582,11 +34290,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -35657,11 +34361,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -35688,11 +34388,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -35745,7 +34441,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -35761,7 +34461,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -35790,8 +34490,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -35871,8 +34571,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -35889,11 +34589,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -35937,11 +34633,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -35983,11 +34675,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -36005,11 +34693,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -36025,8 +34709,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -36038,13 +34722,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -36078,11 +34762,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -36114,8 +34794,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -36206,11 +34886,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -36233,11 +34909,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -36291,7 +34963,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -36318,7 +34990,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -36334,11 +35006,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -36377,11 +35045,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -36428,8 +35092,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -36450,8 +35114,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -36500,7 +35164,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -36565,13 +35229,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -36599,7 +35263,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -36638,6 +35302,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -36645,11 +35314,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -36673,7 +35337,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -36788,11 +35452,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -36863,11 +35523,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -36894,11 +35550,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -36951,7 +35603,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -36967,7 +35623,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -36996,8 +35652,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -37077,8 +35733,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -37095,11 +35751,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -37143,11 +35795,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -37189,11 +35837,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -37211,11 +35855,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -37231,8 +35871,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -37244,13 +35884,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -37284,11 +35924,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -37320,8 +35956,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -37412,11 +36048,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -37439,11 +36071,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -37497,7 +36125,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -37524,7 +36152,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -37540,11 +36168,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -37583,11 +36207,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -37634,8 +36254,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -37656,8 +36276,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -37706,7 +36326,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -37771,13 +36391,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -37805,7 +36425,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -37844,6 +36464,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -37851,11 +36476,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -37879,7 +36499,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -37994,11 +36614,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -38069,11 +36685,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -38100,11 +36712,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -38157,7 +36765,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -38173,7 +36785,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -38202,8 +36814,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -38283,8 +36895,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -38301,11 +36913,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -38349,11 +36957,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -38395,11 +36999,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -38417,11 +37017,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -38437,8 +37033,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -38450,13 +37046,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -38490,11 +37086,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -38526,8 +37118,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -38618,11 +37210,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -38645,11 +37233,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -38703,7 +37287,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -38730,7 +37314,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -38746,11 +37330,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -38789,11 +37369,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -38840,8 +37416,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -38862,8 +37438,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -38912,7 +37488,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -38977,13 +37553,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -39011,7 +37587,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -39050,6 +37626,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -39057,11 +37638,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -39085,7 +37661,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -39200,11 +37776,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -39275,11 +37847,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -39306,11 +37874,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -39363,7 +37927,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -39379,7 +37947,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -39408,8 +37976,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -39489,8 +38057,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -39507,11 +38075,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -39555,11 +38119,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -39601,11 +38161,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -39623,11 +38179,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -39643,8 +38195,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -39656,13 +38208,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -39696,11 +38248,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -39732,8 +38280,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -39824,11 +38372,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -39851,11 +38395,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -39909,7 +38449,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -39936,7 +38476,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -39952,11 +38492,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -39995,11 +38531,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -40046,8 +38578,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -40068,8 +38600,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -40118,7 +38650,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -40183,13 +38715,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -40217,7 +38749,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -40256,6 +38788,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -40263,11 +38800,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -40291,7 +38823,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -40406,11 +38938,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -40481,11 +39009,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -40512,11 +39036,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -40569,7 +39089,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -40585,7 +39109,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -40614,8 +39138,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -40695,8 +39219,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -40713,11 +39237,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -40761,11 +39281,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -40807,11 +39323,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -40829,11 +39341,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -40849,8 +39357,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -40862,13 +39370,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -40902,11 +39410,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -40938,8 +39442,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -41030,11 +39534,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -41057,11 +39557,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -41115,7 +39611,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -41142,7 +39638,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -41158,11 +39654,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -41201,11 +39693,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -41252,8 +39740,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -41274,8 +39762,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -41324,7 +39812,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -41389,13 +39877,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -41423,7 +39911,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -41462,6 +39950,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -41469,11 +39962,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -41497,7 +39985,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -41612,11 +40100,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -41687,11 +40171,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -41718,11 +40198,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -41775,7 +40251,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -41791,7 +40271,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -41820,8 +40300,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -41901,8 +40381,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -41919,11 +40399,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -41967,11 +40443,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -42013,11 +40485,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -42035,11 +40503,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -42055,8 +40519,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -42068,13 +40532,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -42108,11 +40572,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -42144,8 +40604,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -42236,11 +40696,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -42263,11 +40719,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -42321,7 +40773,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -42348,7 +40800,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -42364,11 +40816,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -42407,11 +40855,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -42458,8 +40902,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -42480,8 +40924,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -42530,7 +40974,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -42595,13 +41039,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -42629,7 +41073,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -42668,6 +41112,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -42675,11 +41124,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -42703,7 +41147,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -42818,11 +41262,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -42893,11 +41333,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -42924,11 +41360,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -42981,7 +41413,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -42997,7 +41433,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -43026,8 +41462,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -43107,8 +41543,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -43125,11 +41561,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -43173,11 +41605,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -43219,11 +41647,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -43241,11 +41665,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -43261,8 +41681,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -43274,13 +41694,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -43314,11 +41734,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -43350,8 +41766,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -43442,11 +41858,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -43469,11 +41881,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -43527,7 +41935,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -43554,7 +41962,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -43570,11 +41978,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -43613,11 +42017,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -43664,8 +42064,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -43686,8 +42086,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -43736,7 +42136,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -43801,13 +42201,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -43835,7 +42235,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -43874,6 +42274,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -43881,11 +42286,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -43909,7 +42309,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -44024,11 +42424,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -44099,11 +42495,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -44130,11 +42522,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -44187,7 +42575,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -44203,7 +42595,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -44232,8 +42624,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -44313,8 +42705,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -44331,11 +42723,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -44379,11 +42767,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -44425,11 +42809,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -44447,11 +42827,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -44467,8 +42843,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -44480,13 +42856,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -44520,11 +42896,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -44556,8 +42928,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -44648,11 +43020,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -44675,11 +43043,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -44733,7 +43097,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -44760,7 +43124,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -44776,11 +43140,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -44819,11 +43179,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -44870,8 +43226,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -44892,8 +43248,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -44942,7 +43298,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -45007,13 +43363,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -45041,7 +43397,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -45080,6 +43436,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -45087,11 +43448,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -45115,7 +43471,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -45230,11 +43586,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -45305,11 +43657,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -45336,11 +43684,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -45393,7 +43737,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -45409,7 +43757,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -45438,8 +43786,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -45519,8 +43867,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -45537,11 +43885,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -45585,11 +43929,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -45631,11 +43971,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -45653,11 +43989,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -45673,8 +44005,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -45686,13 +44018,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -45726,11 +44058,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -45762,8 +44090,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -45854,11 +44182,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -45881,11 +44205,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -45939,7 +44259,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -45966,7 +44286,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -45982,11 +44302,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -46025,11 +44341,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -46076,8 +44388,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -46098,8 +44410,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -46148,7 +44460,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -46213,13 +44525,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -46247,7 +44559,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -46286,6 +44598,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -46293,11 +44610,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -46321,7 +44633,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -46436,11 +44748,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -46511,11 +44819,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -46542,11 +44846,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -46599,7 +44899,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -46615,7 +44919,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -46644,8 +44948,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -46725,8 +45029,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -46743,11 +45047,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -46791,11 +45091,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -46837,11 +45133,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -46859,11 +45151,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -46879,8 +45167,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -46892,13 +45180,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -46932,11 +45220,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -46968,8 +45252,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -47060,11 +45344,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -47087,11 +45367,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -47145,7 +45421,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -47172,7 +45448,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -47188,11 +45464,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -47231,11 +45503,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -47282,8 +45550,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -47304,8 +45572,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -47354,7 +45622,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -47419,13 +45687,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -47453,7 +45721,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -47492,6 +45760,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -47499,11 +45772,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -47527,7 +45795,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -47642,11 +45910,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -47717,11 +45981,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -47748,11 +46008,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -47805,7 +46061,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -47821,7 +46081,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -47850,8 +46110,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -47931,8 +46191,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -47949,11 +46209,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -47997,11 +46253,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -48043,11 +46295,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -48065,11 +46313,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -48085,8 +46329,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -48098,13 +46342,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -48138,11 +46382,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -48174,8 +46414,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -48266,11 +46506,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -48293,11 +46529,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -48351,7 +46583,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -48378,7 +46610,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -48394,11 +46626,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -48437,11 +46665,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -48488,8 +46712,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -48510,8 +46734,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -48560,7 +46784,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -48625,13 +46849,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -48659,7 +46883,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -48698,6 +46922,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -48705,11 +46934,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -48733,7 +46957,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -48848,11 +47072,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -48923,11 +47143,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -48954,11 +47170,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -49011,7 +47223,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -49027,7 +47243,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -49056,8 +47272,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -49137,8 +47353,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -49155,11 +47371,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -49203,11 +47415,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -49249,11 +47457,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -49271,11 +47475,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -49291,8 +47491,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -49304,13 +47504,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -49344,11 +47544,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -49380,8 +47576,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -49472,11 +47668,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -49499,11 +47691,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -49557,7 +47745,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -49584,7 +47772,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -49600,11 +47788,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -49643,11 +47827,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -49694,8 +47874,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -49716,8 +47896,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -49766,7 +47946,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -49831,13 +48011,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -49865,7 +48045,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -49904,6 +48084,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -49911,11 +48096,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -49939,7 +48119,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -50054,11 +48234,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -50129,11 +48305,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -50160,11 +48332,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -50217,7 +48385,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -50233,7 +48405,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -50262,8 +48434,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -50343,8 +48515,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -50361,11 +48533,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -50409,11 +48577,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -50455,11 +48619,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -50477,11 +48637,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -50497,8 +48653,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -50510,13 +48666,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -50550,11 +48706,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -50586,8 +48738,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -50678,11 +48830,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -50705,11 +48853,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -50763,7 +48907,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -50790,7 +48934,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -50806,11 +48950,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -50849,11 +48989,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -50900,8 +49036,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -50922,8 +49058,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -50972,7 +49108,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -51037,13 +49173,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -51071,7 +49207,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -51110,6 +49246,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -51117,11 +49258,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -51145,7 +49281,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -51260,11 +49396,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -51335,11 +49467,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -51366,11 +49494,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -51423,7 +49547,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -51439,7 +49567,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -51468,8 +49596,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -51549,8 +49677,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -51567,11 +49695,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -51615,11 +49739,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -51661,11 +49781,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -51683,11 +49799,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -51703,8 +49815,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -51716,13 +49828,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -51756,11 +49868,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -51792,8 +49900,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -51884,11 +49992,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -51911,11 +50015,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -51969,7 +50069,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -51996,7 +50096,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -52012,11 +50112,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -52055,11 +50151,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -52106,8 +50198,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -52128,8 +50220,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -52178,7 +50270,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -52243,13 +50335,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -52277,7 +50369,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -52316,6 +50408,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -52323,11 +50420,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -52351,7 +50443,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -52466,11 +50558,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -52541,11 +50629,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -52572,11 +50656,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -52629,7 +50709,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -52645,7 +50729,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -52674,8 +50758,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -52755,8 +50839,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -52773,11 +50857,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -52821,11 +50901,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -52867,11 +50943,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -52889,11 +50961,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -52909,8 +50977,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -52922,13 +50990,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -52962,11 +51030,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -52998,8 +51062,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -53090,11 +51154,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -53117,11 +51177,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -53175,7 +51231,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -53202,7 +51258,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -53218,11 +51274,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -53261,11 +51313,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -53312,8 +51360,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -53334,8 +51382,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -53384,7 +51432,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -53449,13 +51497,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -53483,7 +51531,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -53522,6 +51570,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -53529,11 +51582,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -53557,7 +51605,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -53672,11 +51720,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -53747,11 +51791,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -53778,11 +51818,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -53835,7 +51871,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -53851,7 +51891,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -53880,8 +51920,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -53961,8 +52001,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -53979,11 +52019,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -54027,11 +52063,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -54073,11 +52105,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -54095,11 +52123,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -54115,8 +52139,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -54128,13 +52152,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -54168,11 +52192,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -54204,8 +52224,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -54296,11 +52316,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -54323,11 +52339,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -54381,7 +52393,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -54408,7 +52420,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -54424,11 +52436,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -54467,11 +52475,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -54518,8 +52522,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -54540,8 +52544,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -54590,7 +52594,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -54655,13 +52659,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -54689,7 +52693,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -54728,6 +52732,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -54735,11 +52744,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -54763,7 +52767,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -54878,11 +52882,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -54953,11 +52953,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -54984,11 +52980,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -55041,7 +53033,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -55057,7 +53053,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -55086,8 +53082,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -55167,8 +53163,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -55185,11 +53181,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -55233,11 +53225,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -55279,11 +53267,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -55301,11 +53285,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -55321,8 +53301,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -55334,13 +53314,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -55374,11 +53354,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -55410,8 +53386,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -55502,11 +53478,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -55529,11 +53501,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -55587,7 +53555,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -55614,7 +53582,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -55630,11 +53598,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -55673,11 +53637,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -55724,8 +53684,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -55746,8 +53706,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -55796,7 +53756,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -55861,13 +53821,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -55895,7 +53855,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -55934,6 +53894,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -55941,11 +53906,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -55969,7 +53929,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -56084,11 +54044,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -56159,11 +54115,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -56190,11 +54142,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -56247,7 +54195,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -56263,7 +54215,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -56292,8 +54244,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -56373,8 +54325,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -56391,11 +54343,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -56439,11 +54387,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -56485,11 +54429,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -56507,11 +54447,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -56527,8 +54463,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -56540,13 +54476,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -56580,11 +54516,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -56616,8 +54548,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -56708,11 +54640,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -56735,11 +54663,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -56793,7 +54717,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -56820,7 +54744,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -56836,11 +54760,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -56879,11 +54799,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -56930,8 +54846,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -56952,8 +54868,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -57002,7 +54918,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -57067,13 +54983,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -57101,7 +55017,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -57140,6 +55056,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -57147,11 +55068,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -57175,7 +55091,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -57290,11 +55206,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -57365,11 +55277,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -57396,11 +55304,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -57453,7 +55357,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -57469,7 +55377,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -57498,8 +55406,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -57579,8 +55487,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -57597,11 +55505,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -57645,11 +55549,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -57691,11 +55591,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -57713,11 +55609,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -57733,8 +55625,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -57746,13 +55638,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -57786,11 +55678,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -57822,8 +55710,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -57914,11 +55802,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -57941,11 +55825,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -57999,7 +55879,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -58026,7 +55906,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -58042,11 +55922,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -58085,11 +55961,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -58136,8 +56008,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -58158,8 +56030,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -58208,7 +56080,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -58273,13 +56145,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -58307,7 +56179,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -58346,6 +56218,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -58353,11 +56230,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -58381,7 +56253,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -58496,11 +56368,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -58571,11 +56439,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -58602,11 +56466,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -58659,7 +56519,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -58675,7 +56539,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -58704,8 +56568,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -58785,8 +56649,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -58803,11 +56667,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -58851,11 +56711,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -58897,11 +56753,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -58919,11 +56771,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -58939,8 +56787,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -58952,13 +56800,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -58992,11 +56840,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -59028,8 +56872,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -59120,11 +56964,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -59147,11 +56987,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -59205,7 +57041,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -59232,7 +57068,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -59248,11 +57084,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -59291,11 +57123,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -59342,8 +57170,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -59364,8 +57192,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -59414,7 +57242,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -59479,13 +57307,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -59513,7 +57341,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -59552,6 +57380,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -59559,11 +57392,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -59587,7 +57415,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -59702,11 +57530,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -59777,11 +57601,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -59808,11 +57628,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -59865,7 +57681,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -59881,7 +57701,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -59910,8 +57730,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -59991,8 +57811,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -60009,11 +57829,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -60057,11 +57873,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -60103,11 +57915,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -60125,11 +57933,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -60145,8 +57949,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -60158,13 +57962,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -60198,11 +58002,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -60234,8 +58034,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -60326,11 +58126,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -60353,11 +58149,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -60411,7 +58203,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -60438,7 +58230,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -60454,11 +58246,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -60497,11 +58285,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -60548,8 +58332,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -60570,8 +58354,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -60620,7 +58404,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -60685,13 +58469,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -60719,7 +58503,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -60758,6 +58542,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -60765,11 +58554,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -60793,7 +58577,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -60908,11 +58692,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -60983,11 +58763,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -61014,11 +58790,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -61071,7 +58843,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -61087,7 +58863,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -61116,8 +58892,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -61197,8 +58973,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -61215,11 +58991,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -61263,11 +59035,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -61309,11 +59077,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -61331,11 +59095,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -61351,8 +59111,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -61364,13 +59124,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -61404,11 +59164,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -61440,8 +59196,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -61532,11 +59288,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -61559,11 +59311,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -61617,7 +59365,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -61644,7 +59392,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -61660,11 +59408,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -61703,11 +59447,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -61754,8 +59494,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -61776,8 +59516,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -61826,7 +59566,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -61891,13 +59631,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -61925,7 +59665,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -61964,6 +59704,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -61971,11 +59716,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -61999,7 +59739,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -62114,11 +59854,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -62189,11 +59925,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -62220,11 +59952,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -62277,7 +60005,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -62293,7 +60025,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -62322,8 +60054,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -62403,8 +60135,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -62421,11 +60153,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -62469,11 +60197,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -62515,11 +60239,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -62537,11 +60257,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -62557,8 +60273,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -62570,13 +60286,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -62610,11 +60326,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -62646,8 +60358,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -62738,11 +60450,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -62765,11 +60473,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -62823,7 +60527,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -62850,7 +60554,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -62866,11 +60570,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -62909,11 +60609,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -62960,8 +60656,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -62982,8 +60678,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -63032,7 +60728,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -63097,13 +60793,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -63131,7 +60827,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -63170,6 +60866,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -63177,11 +60878,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -63205,7 +60901,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -63320,11 +61016,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -63395,11 +61087,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -63426,11 +61114,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -63483,7 +61167,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -63499,7 +61187,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -63528,8 +61216,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -63609,8 +61297,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -63627,11 +61315,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -63675,11 +61359,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -63721,11 +61401,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -63743,11 +61419,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -63763,8 +61435,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -63776,13 +61448,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -63816,11 +61488,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -63852,8 +61520,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -63944,11 +61612,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -63971,11 +61635,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -64029,7 +61689,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -64056,7 +61716,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -64072,11 +61732,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -64115,11 +61771,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -64166,8 +61818,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -64188,8 +61840,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -64238,7 +61890,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -64303,13 +61955,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -64337,7 +61989,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -64376,6 +62028,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -64383,11 +62040,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -64411,7 +62063,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -64526,11 +62178,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -64601,11 +62249,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -64632,11 +62276,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -64689,7 +62329,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -64705,7 +62349,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -64734,8 +62378,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -64815,8 +62459,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -64833,11 +62477,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -64881,11 +62521,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -64927,11 +62563,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -64949,11 +62581,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -64969,8 +62597,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -64982,13 +62610,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -65022,11 +62650,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -65058,8 +62682,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -65150,11 +62774,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -65177,11 +62797,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -65235,7 +62851,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -65262,7 +62878,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -65278,11 +62894,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -65321,11 +62933,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -65372,8 +62980,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -65394,8 +63002,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -65444,7 +63052,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -65509,13 +63117,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -65543,7 +63151,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -65582,6 +63190,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -65589,11 +63202,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -65617,7 +63225,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -65732,11 +63340,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -65807,11 +63411,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -65838,11 +63438,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -65895,7 +63491,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -65911,7 +63511,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -65940,8 +63540,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -66021,8 +63621,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -66039,11 +63639,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -66087,11 +63683,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -66133,11 +63725,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -66155,11 +63743,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -66175,8 +63759,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -66188,13 +63772,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -66228,11 +63812,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -66264,8 +63844,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -66356,11 +63936,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -66383,11 +63959,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -66441,7 +64013,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -66468,7 +64040,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -66484,11 +64056,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -66527,11 +64095,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -66578,8 +64142,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -66600,8 +64164,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -66650,7 +64214,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -66715,13 +64279,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -66749,7 +64313,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -66788,6 +64352,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -66795,11 +64364,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -66823,7 +64387,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -66938,11 +64502,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -67013,11 +64573,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -67044,11 +64600,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -67101,7 +64653,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -67117,7 +64673,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -67146,8 +64702,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -67227,8 +64783,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -67245,11 +64801,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -67293,11 +64845,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -67339,11 +64887,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -67361,11 +64905,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -67381,8 +64921,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -67394,13 +64934,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -67434,11 +64974,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -67470,8 +65006,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -67562,11 +65098,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -67589,11 +65121,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -67647,7 +65175,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -67674,7 +65202,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -67690,11 +65218,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -67733,11 +65257,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -67784,8 +65304,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -67806,8 +65326,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -67856,7 +65376,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -67921,13 +65441,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -67955,7 +65475,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -67994,6 +65514,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -68001,11 +65526,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -68029,7 +65549,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -68144,11 +65664,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -68219,11 +65735,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -68250,11 +65762,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -68307,7 +65815,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -68323,7 +65835,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -68352,8 +65864,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -68433,8 +65945,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -68451,11 +65963,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -68499,11 +66007,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -68545,11 +66049,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -68567,11 +66067,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -68587,8 +66083,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -68600,13 +66096,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -68640,11 +66136,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -68676,8 +66168,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -68768,11 +66260,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -68795,11 +66283,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -68853,7 +66337,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -68880,7 +66364,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -68896,11 +66380,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -68939,11 +66419,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -68990,8 +66466,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -69012,8 +66488,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -69062,7 +66538,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -69127,13 +66603,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -69161,7 +66637,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -69200,6 +66676,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -69207,11 +66688,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -69235,7 +66711,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -69350,11 +66826,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -69425,11 +66897,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -69456,11 +66924,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -69513,7 +66977,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -69529,7 +66997,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -69558,8 +67026,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -69639,8 +67107,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -69657,11 +67125,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -69705,11 +67169,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -69751,11 +67211,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -69773,11 +67229,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -69793,8 +67245,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -69806,13 +67258,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -69846,11 +67298,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -69882,8 +67330,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -69974,11 +67422,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -70001,11 +67445,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -70059,7 +67499,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -70086,7 +67526,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -70102,11 +67542,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -70145,11 +67581,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -70196,8 +67628,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -70218,8 +67650,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -70268,7 +67700,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -70333,13 +67765,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -70367,7 +67799,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -70406,6 +67838,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -70413,11 +67850,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -70441,7 +67873,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -70556,11 +67988,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -70631,11 +68059,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -70662,11 +68086,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -70719,7 +68139,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -70735,7 +68159,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -70764,8 +68188,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -70845,8 +68269,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -70863,11 +68287,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -70911,11 +68331,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -70957,11 +68373,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -70979,11 +68391,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -70999,8 +68407,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -71012,13 +68420,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -71052,11 +68460,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -71088,8 +68492,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -71180,11 +68584,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -71207,11 +68607,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -71265,7 +68661,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -71292,7 +68688,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -71308,11 +68704,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -71351,11 +68743,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -71402,8 +68790,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -71424,8 +68812,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -71474,7 +68862,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -71539,13 +68927,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -71573,7 +68961,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -71612,6 +69000,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -71619,11 +69012,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -71647,7 +69035,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -71762,11 +69150,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -71837,11 +69221,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -71868,11 +69248,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -71925,7 +69301,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -71941,7 +69321,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -71970,8 +69350,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -72051,8 +69431,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -72069,11 +69449,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -72117,11 +69493,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -72163,11 +69535,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -72185,11 +69553,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -72205,8 +69569,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -72218,13 +69582,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -72258,11 +69622,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -72294,8 +69654,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -72386,11 +69746,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -72413,11 +69769,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -72471,7 +69823,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -72498,7 +69850,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -72514,11 +69866,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -72557,11 +69905,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -72608,8 +69952,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -72630,8 +69974,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -72680,7 +70024,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -72745,13 +70089,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -72779,7 +70123,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -72818,6 +70162,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -72825,11 +70174,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -72853,7 +70197,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -72968,11 +70312,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -73043,11 +70383,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -73074,11 +70410,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -73131,7 +70463,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -73147,7 +70483,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -73176,8 +70512,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -73257,8 +70593,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -73275,11 +70611,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -73323,11 +70655,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -73369,11 +70697,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -73391,11 +70715,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -73411,8 +70731,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -73424,13 +70744,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -73464,11 +70784,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -73500,8 +70816,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -73592,11 +70908,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -73619,11 +70931,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -73677,7 +70985,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -73704,7 +71012,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -73720,11 +71028,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -73763,11 +71067,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -73814,8 +71114,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -73836,8 +71136,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -73886,7 +71186,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -73951,13 +71251,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -73985,7 +71285,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -74024,6 +71324,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -74031,11 +71336,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -74059,7 +71359,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -74174,11 +71474,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -74249,11 +71545,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -74280,11 +71572,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -74337,7 +71625,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -74353,7 +71645,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -74382,8 +71674,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -74463,8 +71755,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -74481,11 +71773,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -74529,11 +71817,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -74575,11 +71859,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -74597,11 +71877,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -74617,8 +71893,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -74630,13 +71906,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -74670,11 +71946,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -74706,8 +71978,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -74798,11 +72070,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -74825,11 +72093,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -74883,7 +72147,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -74910,7 +72174,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -74926,11 +72190,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -74969,11 +72229,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -75020,8 +72276,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -75042,8 +72298,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -75092,7 +72348,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -75157,13 +72413,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -75191,7 +72447,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -75230,6 +72486,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -75237,11 +72498,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -75265,7 +72521,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -75380,11 +72636,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -75455,11 +72707,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -75486,11 +72734,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -75543,7 +72787,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -75559,7 +72807,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -75588,8 +72836,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -75669,8 +72917,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -75687,11 +72935,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -75735,11 +72979,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -75781,11 +73021,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -75803,11 +73039,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -75823,8 +73055,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -75836,13 +73068,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -75876,11 +73108,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -75912,8 +73140,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -76004,11 +73232,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -76031,11 +73255,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -76089,7 +73309,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -76116,7 +73336,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -76132,11 +73352,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -76175,11 +73391,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -76226,8 +73438,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -76248,8 +73460,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -76298,7 +73510,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -76363,13 +73575,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -76397,7 +73609,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -76436,6 +73648,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -76443,11 +73660,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -76471,7 +73683,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -76586,11 +73798,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -76661,11 +73869,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -76692,11 +73896,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -76749,7 +73949,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -76765,7 +73969,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -76794,8 +73998,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -76875,8 +74079,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -76893,11 +74097,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -76941,11 +74141,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -76987,11 +74183,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -77009,11 +74201,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -77029,8 +74217,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -77042,13 +74230,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -77082,11 +74270,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -77118,8 +74302,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -77210,11 +74394,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -77237,11 +74417,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -77295,7 +74471,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -77322,7 +74498,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -77338,11 +74514,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -77381,11 +74553,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -77432,8 +74600,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -77454,8 +74622,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -77504,7 +74672,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -77569,13 +74737,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -77603,7 +74771,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -77642,6 +74810,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -77649,11 +74822,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -77677,7 +74845,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -77792,11 +74960,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -77867,11 +75031,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -77898,11 +75058,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -77955,7 +75111,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -77971,7 +75131,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -78000,8 +75160,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -78081,8 +75241,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -78099,11 +75259,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -78147,11 +75303,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -78193,11 +75345,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -78215,11 +75363,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -78235,8 +75379,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -78248,13 +75392,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -78288,11 +75432,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -78324,8 +75464,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -78416,11 +75556,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -78443,11 +75579,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -78501,7 +75633,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -78528,7 +75660,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -78544,11 +75676,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -78587,11 +75715,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -78638,8 +75762,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -78660,8 +75784,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -78710,7 +75834,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -78775,13 +75899,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -78809,7 +75933,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -78848,6 +75972,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -78855,11 +75984,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -78883,7 +76007,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -78998,11 +76122,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -79073,11 +76193,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -79104,11 +76220,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -79161,7 +76273,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -79177,7 +76293,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -79206,8 +76322,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -79287,8 +76403,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -79305,11 +76421,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -79353,11 +76465,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -79399,11 +76507,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -79421,11 +76525,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -79441,8 +76541,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -79454,13 +76554,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -79494,11 +76594,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -79530,8 +76626,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -79622,11 +76718,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -79649,11 +76741,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -79707,7 +76795,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -79734,7 +76822,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -79750,11 +76838,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -79793,11 +76877,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -79844,8 +76924,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -79866,8 +76946,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -79916,7 +76996,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -79981,13 +77061,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -80015,7 +77095,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -80054,6 +77134,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -80061,11 +77146,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -80089,7 +77169,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -80204,11 +77284,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -80279,11 +77355,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -80310,11 +77382,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -80367,7 +77435,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -80383,7 +77455,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -80412,8 +77484,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -80493,8 +77565,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -80511,11 +77583,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -80559,11 +77627,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -80605,11 +77669,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -80627,11 +77687,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -80647,8 +77703,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -80660,13 +77716,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -80700,11 +77756,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -80736,8 +77788,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -80828,11 +77880,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -80855,11 +77903,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -80913,7 +77957,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -80940,7 +77984,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -80956,11 +78000,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -80999,11 +78039,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -81050,8 +78086,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -81072,8 +78108,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -81122,7 +78158,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -81187,13 +78223,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -81221,7 +78257,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -81260,6 +78296,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -81267,11 +78308,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -81295,7 +78331,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -81410,11 +78446,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -81485,11 +78517,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -81516,11 +78544,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -81573,7 +78597,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -81589,7 +78617,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -81618,8 +78646,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -81699,8 +78727,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -81717,11 +78745,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -81765,11 +78789,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -81811,11 +78831,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -81833,11 +78849,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -81853,8 +78865,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -81866,13 +78878,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -81906,11 +78918,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -81942,8 +78950,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -82034,11 +79042,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -82061,11 +79065,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -82119,7 +79119,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -82146,7 +79146,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -82162,11 +79162,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -82205,11 +79201,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -82256,8 +79248,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -82278,8 +79270,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -82328,7 +79320,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -82393,13 +79385,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -82427,7 +79419,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -82466,6 +79458,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -82473,11 +79470,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -82501,7 +79493,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -82616,11 +79608,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -82691,11 +79679,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -82722,11 +79706,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -82779,7 +79759,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -82795,7 +79779,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -82824,8 +79808,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -82905,8 +79889,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -82923,11 +79907,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -82971,11 +79951,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -83017,11 +79993,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -83039,11 +80011,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -83059,8 +80027,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -83072,13 +80040,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -83112,11 +80080,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -83148,8 +80112,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -83240,11 +80204,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -83267,11 +80227,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -83325,7 +80281,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -83352,7 +80308,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -83368,11 +80324,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -83411,11 +80363,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -83462,8 +80410,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -83484,8 +80432,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -83534,7 +80482,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -83599,13 +80547,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -83633,7 +80581,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -83672,6 +80620,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -83679,11 +80632,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -83707,7 +80655,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -83822,11 +80770,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -83897,11 +80841,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -83928,11 +80868,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -83985,7 +80921,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -84001,7 +80941,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -84030,8 +80970,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -84111,8 +81051,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -84129,11 +81069,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -84177,11 +81113,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -84223,11 +81155,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -84245,11 +81173,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -84265,8 +81189,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -84278,13 +81202,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -84318,11 +81242,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -84354,8 +81274,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -84446,11 +81366,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -84473,11 +81389,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -84531,7 +81443,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -84558,7 +81470,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -84574,11 +81486,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -84617,11 +81525,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -84668,8 +81572,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -84690,8 +81594,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -84740,7 +81644,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -84805,13 +81709,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -84839,7 +81743,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -84878,6 +81782,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -84885,11 +81794,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -84913,7 +81817,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -85028,11 +81932,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -85103,11 +82003,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -85134,11 +82030,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -85191,7 +82083,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -85207,7 +82103,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -85236,8 +82132,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -85317,8 +82213,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -85335,11 +82231,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -85383,11 +82275,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -85429,11 +82317,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -85451,11 +82335,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -85471,8 +82351,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -85484,13 +82364,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -85524,11 +82404,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -85560,8 +82436,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -85652,11 +82528,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -85679,11 +82551,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -85737,7 +82605,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -85764,7 +82632,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -85780,11 +82648,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -85823,11 +82687,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -85874,8 +82734,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -85896,8 +82756,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -85946,7 +82806,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -86011,13 +82871,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -86045,7 +82905,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -86084,6 +82944,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -86091,11 +82956,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -86119,7 +82979,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -86234,11 +83094,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -86309,11 +83165,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -86340,11 +83192,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -86397,7 +83245,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -86413,7 +83265,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -86442,8 +83294,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -86523,8 +83375,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -86541,11 +83393,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -86589,11 +83437,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -86635,11 +83479,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -86657,11 +83497,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -86677,8 +83513,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -86690,13 +83526,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -86730,11 +83566,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -86766,8 +83598,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -86858,11 +83690,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -86885,11 +83713,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -86943,7 +83767,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -86970,7 +83794,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -86986,11 +83810,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -87029,11 +83849,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -87080,8 +83896,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -87102,8 +83918,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -87152,7 +83968,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -87217,13 +84033,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -87251,7 +84067,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -87290,6 +84106,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -87297,11 +84118,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -87325,7 +84141,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -87440,11 +84256,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -87515,11 +84327,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -87546,11 +84354,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -87603,7 +84407,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -87619,7 +84427,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -87648,8 +84456,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -87729,8 +84537,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -87747,11 +84555,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -87795,11 +84599,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -87841,11 +84641,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -87863,11 +84659,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -87883,8 +84675,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -87896,13 +84688,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -87936,11 +84728,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -87972,8 +84760,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -88064,11 +84852,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -88091,11 +84875,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -88149,7 +84929,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -88176,7 +84956,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -88192,11 +84972,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -88235,11 +85011,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -88286,8 +85058,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -88308,8 +85080,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -88358,7 +85130,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -88423,13 +85195,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -88457,7 +85229,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -88496,6 +85268,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -88503,11 +85280,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -88531,7 +85303,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -88646,11 +85418,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -88721,11 +85489,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -88752,11 +85516,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -88809,7 +85569,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -88825,7 +85589,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -88854,8 +85618,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -88935,8 +85699,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -88953,11 +85717,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -89001,11 +85761,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -89047,11 +85803,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -89069,11 +85821,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -89089,8 +85837,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -89102,13 +85850,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -89142,11 +85890,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -89178,8 +85922,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -89270,11 +86014,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -89297,11 +86037,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -89355,7 +86091,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -89382,7 +86118,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -89398,11 +86134,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -89441,11 +86173,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -89492,8 +86220,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -89514,8 +86242,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -89564,7 +86292,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -89629,13 +86357,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -89663,7 +86391,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -89702,6 +86430,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -89709,11 +86442,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -89737,7 +86465,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -89852,11 +86580,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -89927,11 +86651,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -89958,11 +86678,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -90015,7 +86731,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -90031,7 +86751,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -90060,8 +86780,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -90141,8 +86861,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -90159,11 +86879,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -90207,11 +86923,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -90253,11 +86965,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -90275,11 +86983,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -90295,8 +86999,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -90308,13 +87012,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -90348,11 +87052,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -90384,8 +87084,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -90476,11 +87176,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -90503,11 +87199,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -90561,7 +87253,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -90588,7 +87280,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -90604,11 +87296,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -90647,11 +87335,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -90698,8 +87382,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -90720,8 +87404,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -90770,7 +87454,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -90835,13 +87519,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -90869,7 +87553,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -90908,6 +87592,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -90915,11 +87604,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -90943,7 +87627,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -91058,11 +87742,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -91133,11 +87813,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -91164,11 +87840,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -91221,7 +87893,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -91237,7 +87913,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -91266,8 +87942,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -91347,8 +88023,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -91365,11 +88041,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -91413,11 +88085,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -91459,11 +88127,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -91481,11 +88145,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -91501,8 +88161,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -91514,13 +88174,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -91554,11 +88214,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -91590,8 +88246,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -91682,11 +88338,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -91709,11 +88361,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -91767,7 +88415,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -91794,7 +88442,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -91810,11 +88458,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -91853,11 +88497,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -91904,8 +88544,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -91926,8 +88566,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -91976,7 +88616,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -92041,13 +88681,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -92075,7 +88715,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -92114,6 +88754,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -92121,11 +88766,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -92149,7 +88789,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -92264,11 +88904,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -92339,11 +88975,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -92370,11 +89002,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -92427,7 +89055,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -92443,7 +89075,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -92472,8 +89104,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -92553,8 +89185,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -92571,11 +89203,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -92619,11 +89247,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -92665,11 +89289,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -92687,11 +89307,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -92707,8 +89323,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -92720,13 +89336,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -92760,11 +89376,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -92796,8 +89408,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -92888,11 +89500,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -92915,11 +89523,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -92973,7 +89577,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -93000,7 +89604,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -93016,11 +89620,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -93059,11 +89659,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -93110,8 +89706,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -93132,8 +89728,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -93182,7 +89778,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -93247,13 +89843,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -93281,7 +89877,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -93320,6 +89916,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -93327,11 +89928,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -93355,7 +89951,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -93470,11 +90066,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -93545,11 +90137,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -93576,11 +90164,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -93633,7 +90217,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -93649,7 +90237,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -93678,8 +90266,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -93759,8 +90347,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -93777,11 +90365,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -93825,11 +90409,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -93871,11 +90451,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -93893,11 +90469,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -93913,8 +90485,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -93926,13 +90498,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -93966,11 +90538,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -94002,8 +90570,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -94094,11 +90662,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -94121,11 +90685,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -94179,7 +90739,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -94206,7 +90766,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -94222,11 +90782,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -94265,11 +90821,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -94316,8 +90868,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -94338,8 +90890,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -94388,7 +90940,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -94453,13 +91005,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -94487,7 +91039,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -94526,6 +91078,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -94533,11 +91090,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -94561,7 +91113,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -94676,11 +91228,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -94751,11 +91299,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -94782,11 +91326,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -94839,7 +91379,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -94855,7 +91399,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -94884,8 +91428,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -94965,8 +91509,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -94983,11 +91527,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -95031,11 +91571,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -95077,11 +91613,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -95099,11 +91631,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -95119,8 +91647,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -95132,13 +91660,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -95172,11 +91700,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -95208,8 +91732,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -95300,11 +91824,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -95327,11 +91847,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -95385,7 +91901,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -95412,7 +91928,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -95428,11 +91944,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -95471,11 +91983,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -95522,8 +92030,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -95544,8 +92052,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -95594,7 +92102,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -95659,13 +92167,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -95693,7 +92201,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -95732,6 +92240,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -95739,11 +92252,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -95767,7 +92275,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -95882,11 +92390,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -95957,11 +92461,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -95988,11 +92488,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -96045,7 +92541,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -96061,7 +92561,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -96090,8 +92590,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -96171,8 +92671,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -96189,11 +92689,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -96237,11 +92733,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -96283,11 +92775,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -96305,11 +92793,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -96325,8 +92809,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -96338,13 +92822,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -96378,11 +92862,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -96414,8 +92894,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -96506,11 +92986,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -96533,11 +93009,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -96591,7 +93063,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -96618,7 +93090,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -96634,11 +93106,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -96677,11 +93145,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -96728,8 +93192,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -96750,8 +93214,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -96800,7 +93264,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -96865,13 +93329,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -96899,7 +93363,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -96938,6 +93402,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -96945,11 +93414,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -96973,7 +93437,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -97088,11 +93552,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -97163,11 +93623,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -97194,11 +93650,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -97251,7 +93703,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -97267,7 +93723,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -97296,8 +93752,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -97377,8 +93833,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -97395,11 +93851,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -97443,11 +93895,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -97489,11 +93937,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -97511,11 +93955,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -97531,8 +93971,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -97544,13 +93984,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -97584,11 +94024,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -97620,8 +94056,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -97712,11 +94148,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -97739,11 +94171,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -97797,7 +94225,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -97824,7 +94252,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -97840,11 +94268,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -97883,11 +94307,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -97934,8 +94354,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -97956,8 +94376,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -98006,7 +94426,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -98071,13 +94491,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -98105,7 +94525,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -98144,6 +94564,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -98151,11 +94576,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -98179,7 +94599,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -98294,11 +94714,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -98369,11 +94785,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -98400,11 +94812,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -98457,7 +94865,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -98473,7 +94885,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -98502,8 +94914,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -98583,8 +94995,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -98601,11 +95013,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -98649,11 +95057,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -98695,11 +95099,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -98717,11 +95117,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -98737,8 +95133,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -98750,13 +95146,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -98790,11 +95186,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -98826,8 +95218,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -98918,11 +95310,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -98945,11 +95333,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -99003,7 +95387,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -99030,7 +95414,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -99046,11 +95430,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -99089,11 +95469,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -99140,8 +95516,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -99162,8 +95538,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -99212,7 +95588,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -99277,13 +95653,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -99311,7 +95687,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -99350,6 +95726,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -99357,11 +95738,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -99385,7 +95761,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -99500,11 +95876,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -99575,11 +95947,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -99606,11 +95974,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -99663,7 +96027,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -99679,7 +96047,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -99708,8 +96076,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -99789,8 +96157,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -99807,11 +96175,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -99855,11 +96219,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -99901,11 +96261,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -99923,11 +96279,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -99943,8 +96295,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -99956,13 +96308,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -99996,11 +96348,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -100032,8 +96380,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -100124,11 +96472,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -100151,11 +96495,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -100209,7 +96549,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -100236,7 +96576,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -100252,11 +96592,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -100295,11 +96631,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -100346,8 +96678,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -100368,8 +96700,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -100418,7 +96750,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -100483,13 +96815,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -100517,7 +96849,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -100556,6 +96888,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -100563,11 +96900,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -100591,7 +96923,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -100706,11 +97038,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -100781,11 +97109,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -100812,11 +97136,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -100869,7 +97189,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -100885,7 +97209,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -100914,8 +97238,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -100995,8 +97319,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -101013,11 +97337,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -101061,11 +97381,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -101107,11 +97423,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -101129,11 +97441,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -101149,8 +97457,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -101162,13 +97470,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -101202,11 +97510,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -101238,8 +97542,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -101330,11 +97634,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -101357,11 +97657,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -101415,7 +97711,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -101442,7 +97738,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -101458,11 +97754,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -101501,11 +97793,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -101552,8 +97840,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -101574,8 +97862,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -101624,7 +97912,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -101689,13 +97977,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -101723,7 +98011,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -101762,6 +98050,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -101769,11 +98062,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -101797,7 +98085,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -101912,11 +98200,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -101987,11 +98271,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -102018,11 +98298,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -102075,7 +98351,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -102091,7 +98371,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -102120,8 +98400,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -102201,8 +98481,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -102219,11 +98499,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -102267,11 +98543,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -102313,11 +98585,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -102335,11 +98603,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -102355,8 +98619,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -102368,13 +98632,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -102408,11 +98672,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -102444,8 +98704,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -102536,11 +98796,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -102563,11 +98819,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -102621,7 +98873,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -102648,7 +98900,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -102664,11 +98916,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -102707,11 +98955,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -102758,8 +99002,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -102780,8 +99024,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -102830,7 +99074,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -102895,13 +99139,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -102929,7 +99173,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -102968,6 +99212,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -102975,11 +99224,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -103003,7 +99247,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -103118,11 +99362,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -103193,11 +99433,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -103224,11 +99460,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -103281,7 +99513,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -103297,7 +99533,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -103326,8 +99562,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -103407,8 +99643,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -103425,11 +99661,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -103473,11 +99705,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -103519,11 +99747,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -103541,11 +99765,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -103561,8 +99781,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -103574,13 +99794,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -103614,11 +99834,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -103650,8 +99866,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -103742,11 +99958,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -103769,11 +99981,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -103827,7 +100035,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -103854,7 +100062,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -103870,11 +100078,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -103913,11 +100117,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -103964,8 +100164,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -103986,8 +100186,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -104036,7 +100236,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -104101,13 +100301,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -104135,7 +100335,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -104174,6 +100374,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -104181,11 +100386,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -104209,7 +100409,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -104324,11 +100524,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -104399,11 +100595,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -104430,11 +100622,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -104487,7 +100675,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -104503,7 +100695,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -104532,8 +100724,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -104613,8 +100805,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -104631,11 +100823,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -104679,11 +100867,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -104725,11 +100909,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -104747,11 +100927,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -104767,8 +100943,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -104780,13 +100956,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -104820,11 +100996,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -104856,8 +101028,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -104948,11 +101120,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -104975,11 +101143,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -105033,7 +101197,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -105060,7 +101224,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -105076,11 +101240,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -105119,11 +101279,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -105170,8 +101326,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -105192,8 +101348,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -105242,7 +101398,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -105307,13 +101463,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -105341,7 +101497,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -105380,6 +101536,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -105387,11 +101548,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -105415,7 +101571,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -105530,11 +101686,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -105605,11 +101757,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -105636,11 +101784,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -105693,7 +101837,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -105709,7 +101857,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -105738,8 +101886,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -105819,8 +101967,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -105837,11 +101985,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -105885,11 +102029,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -105931,11 +102071,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -105953,11 +102089,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -105973,8 +102105,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -105986,13 +102118,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -106026,11 +102158,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -106062,8 +102190,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -106154,11 +102282,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -106181,11 +102305,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -106239,7 +102359,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -106266,7 +102386,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -106282,11 +102402,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -106325,11 +102441,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -106376,8 +102488,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -106398,8 +102510,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -106448,7 +102560,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -106513,13 +102625,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -106547,7 +102659,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -106586,6 +102698,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -106593,11 +102710,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -106621,7 +102733,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -106736,11 +102848,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -106811,11 +102919,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -106842,11 +102946,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -106899,7 +102999,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -106915,7 +103019,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -106944,8 +103048,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -107025,8 +103129,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -107043,11 +103147,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -107091,11 +103191,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -107137,11 +103233,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -107159,11 +103251,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -107179,8 +103267,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -107192,13 +103280,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -107232,11 +103320,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -107268,8 +103352,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -107360,11 +103444,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -107387,11 +103467,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -107445,7 +103521,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -107472,7 +103548,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -107488,11 +103564,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -107531,11 +103603,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -107582,8 +103650,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -107604,8 +103672,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -107654,7 +103722,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -107719,13 +103787,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -107753,7 +103821,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -107792,6 +103860,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -107799,11 +103872,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -107827,7 +103895,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -107942,11 +104010,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -108017,11 +104081,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -108048,11 +104108,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -108105,7 +104161,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -108121,7 +104181,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -108150,8 +104210,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -108231,8 +104291,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -108249,11 +104309,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -108297,11 +104353,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -108343,11 +104395,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -108365,11 +104413,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -108385,8 +104429,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -108398,13 +104442,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -108438,11 +104482,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -108474,8 +104514,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -108566,11 +104606,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -108593,11 +104629,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -108651,7 +104683,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -108678,7 +104710,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -108694,11 +104726,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -108737,11 +104765,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -108788,8 +104812,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -108810,8 +104834,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -108860,7 +104884,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -108925,13 +104949,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -108959,7 +104983,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -108998,6 +105022,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -109005,11 +105034,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -109033,7 +105057,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -109148,11 +105172,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -109223,11 +105243,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -109254,11 +105270,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -109311,7 +105323,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -109327,7 +105343,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -109356,8 +105372,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -109437,8 +105453,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -109455,11 +105471,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -109503,11 +105515,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -109549,11 +105557,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -109571,11 +105575,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -109591,8 +105591,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -109604,13 +105604,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -109644,11 +105644,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -109680,8 +105676,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -109772,11 +105768,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -109799,11 +105791,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -109857,7 +105845,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -109884,7 +105872,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -109900,11 +105888,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -109943,11 +105927,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -109994,8 +105974,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -110016,8 +105996,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -110066,7 +106046,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -110131,13 +106111,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -110165,7 +106145,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -110204,6 +106184,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -110211,11 +106196,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -110239,7 +106219,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -110354,11 +106334,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -110429,11 +106405,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -110460,11 +106432,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -110517,7 +106485,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -110533,7 +106505,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -110562,8 +106534,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -110643,8 +106615,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -110661,11 +106633,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -110709,11 +106677,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -110755,11 +106719,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -110777,11 +106737,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -110797,8 +106753,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -110810,13 +106766,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -110850,11 +106806,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -110886,8 +106838,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -110978,11 +106930,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -111005,11 +106953,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -111063,7 +107007,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -111090,7 +107034,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -111106,11 +107050,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -111149,11 +107089,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -111200,8 +107136,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -111222,8 +107158,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -111272,7 +107208,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -111337,13 +107273,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -111371,7 +107307,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -111410,6 +107346,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -111417,11 +107358,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -111445,7 +107381,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -111560,11 +107496,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -111635,11 +107567,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -111666,11 +107594,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -111723,7 +107647,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -111739,7 +107667,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -111768,8 +107696,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -111849,8 +107777,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -111867,11 +107795,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -111915,11 +107839,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -111961,11 +107881,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -111983,11 +107899,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -112003,8 +107915,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -112016,13 +107928,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -112056,11 +107968,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -112092,8 +108000,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -112184,11 +108092,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -112211,11 +108115,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -112269,7 +108169,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -112296,7 +108196,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -112312,11 +108212,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -112355,11 +108251,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -112406,8 +108298,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -112428,8 +108320,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -112478,7 +108370,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -112543,13 +108435,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -112577,7 +108469,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -112616,6 +108508,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -112623,11 +108520,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -112651,7 +108543,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -112766,11 +108658,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -112841,11 +108729,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -112872,11 +108756,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -112929,7 +108809,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -112945,7 +108829,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -112974,8 +108858,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -113055,8 +108939,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -113073,11 +108957,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -113121,11 +109001,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -113167,11 +109043,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -113189,11 +109061,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -113209,8 +109077,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -113222,13 +109090,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -113262,11 +109130,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -113298,8 +109162,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -113390,11 +109254,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -113417,11 +109277,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -113475,7 +109331,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -113502,7 +109358,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -113518,11 +109374,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -113561,11 +109413,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -113612,8 +109460,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -113634,8 +109482,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -113684,7 +109532,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -113749,13 +109597,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -113783,7 +109631,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -113822,6 +109670,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -113829,11 +109682,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -113857,7 +109705,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -113972,11 +109820,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -114047,11 +109891,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -114078,11 +109918,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -114135,7 +109971,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -114151,7 +109991,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -114180,8 +110020,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -114261,8 +110101,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -114279,11 +110119,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -114327,11 +110163,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -114373,11 +110205,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -114395,11 +110223,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -114415,8 +110239,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -114428,13 +110252,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -114468,11 +110292,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -114504,8 +110324,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -114596,11 +110416,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -114623,11 +110439,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -114681,7 +110493,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -114708,7 +110520,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -114724,11 +110536,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -114767,11 +110575,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -114818,8 +110622,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -114840,8 +110644,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -114890,7 +110694,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -114955,13 +110759,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -114989,7 +110793,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -115028,6 +110832,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -115035,11 +110844,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -115063,7 +110867,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -115178,11 +110982,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -115253,11 +111053,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -115284,11 +111080,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -115341,7 +111133,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -115357,7 +111153,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -115386,8 +111182,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -115467,8 +111263,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -115485,11 +111281,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -115533,11 +111325,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -115579,11 +111367,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -115601,11 +111385,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -115621,8 +111401,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -115634,13 +111414,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -115674,11 +111454,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -115710,8 +111486,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -115802,11 +111578,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -115829,11 +111601,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -115887,7 +111655,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -115914,7 +111682,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -115930,11 +111698,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -115973,11 +111737,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -116024,8 +111784,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -116046,8 +111806,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -116096,7 +111856,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -116161,13 +111921,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -116195,7 +111955,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -116234,6 +111994,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -116241,11 +112006,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -116269,7 +112029,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -116384,11 +112144,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -116459,11 +112215,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -116490,11 +112242,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -116547,7 +112295,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -116563,7 +112315,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -116592,8 +112344,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -116673,8 +112425,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -116691,11 +112443,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -116739,11 +112487,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -116785,11 +112529,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -116807,11 +112547,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -116827,8 +112563,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -116840,13 +112576,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -116880,11 +112616,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -116916,8 +112648,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -117008,11 +112740,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -117035,11 +112763,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -117093,7 +112817,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -117120,7 +112844,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -117136,11 +112860,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -117179,11 +112899,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -117230,8 +112946,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -117252,8 +112968,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -117302,7 +113018,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -117367,13 +113083,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -117401,7 +113117,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -117440,6 +113156,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -117447,11 +113168,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -117475,7 +113191,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -117590,11 +113306,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -117665,11 +113377,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -117696,11 +113404,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -117753,7 +113457,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -117769,7 +113477,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -117798,8 +113506,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -117879,8 +113587,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -117897,11 +113605,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -117945,11 +113649,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -117991,11 +113691,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -118013,11 +113709,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -118033,8 +113725,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -118046,13 +113738,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -118086,11 +113778,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -118122,8 +113810,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -118214,11 +113902,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -118241,11 +113925,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -118299,7 +113979,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -118326,7 +114006,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -118342,11 +114022,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -118385,11 +114061,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -118436,8 +114108,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -118458,8 +114130,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -118508,7 +114180,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -118573,13 +114245,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -118607,7 +114279,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -118646,6 +114318,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -118653,11 +114330,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -118681,7 +114353,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -118796,11 +114468,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -118871,11 +114539,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -118902,11 +114566,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -118959,7 +114619,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -118975,7 +114639,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -119004,8 +114668,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -119085,8 +114749,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -119103,11 +114767,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -119151,11 +114811,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -119197,11 +114853,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -119219,11 +114871,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -119239,8 +114887,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -119252,13 +114900,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -119292,11 +114940,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -119328,8 +114972,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -119420,11 +115064,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -119447,11 +115087,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -119505,7 +115141,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -119532,7 +115168,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -119548,11 +115184,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -119591,11 +115223,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -119642,8 +115270,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -119664,8 +115292,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -119714,7 +115342,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -119779,13 +115407,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -119813,7 +115441,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -119852,6 +115480,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -119859,11 +115492,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -119887,7 +115515,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -120002,11 +115630,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -120077,11 +115701,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -120108,11 +115728,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -120165,7 +115781,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -120181,7 +115801,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -120210,8 +115830,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -120291,8 +115911,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -120309,11 +115929,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -120357,11 +115973,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -120403,11 +116015,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -120425,11 +116033,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -120445,8 +116049,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -120458,13 +116062,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -120498,11 +116102,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -120534,8 +116134,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -120626,11 +116226,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -120653,11 +116249,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -120711,7 +116303,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -120738,7 +116330,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -120754,11 +116346,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -120797,11 +116385,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -120848,8 +116432,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -120870,8 +116454,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -120920,7 +116504,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -120985,13 +116569,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -121019,7 +116603,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -121058,6 +116642,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -121065,11 +116654,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -121093,7 +116677,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -121208,11 +116792,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -121283,11 +116863,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -121314,11 +116890,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -121371,7 +116943,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -121387,7 +116963,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -121416,8 +116992,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -121497,8 +117073,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -121515,11 +117091,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -121563,11 +117135,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -121609,11 +117177,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -121631,11 +117195,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -121651,8 +117211,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -121664,13 +117224,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -121704,11 +117264,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -121740,8 +117296,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -121832,11 +117388,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -121859,11 +117411,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -121917,7 +117465,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -121944,7 +117492,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -121960,11 +117508,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -122003,11 +117547,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -122054,8 +117594,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -122076,8 +117616,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -122126,7 +117666,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -122191,13 +117731,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -122225,7 +117765,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -122264,6 +117804,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -122271,11 +117816,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -122299,7 +117839,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -122414,11 +117954,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -122489,11 +118025,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -122520,11 +118052,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -122577,7 +118105,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -122593,7 +118125,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -122622,8 +118154,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -122703,8 +118235,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -122721,11 +118253,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -122769,11 +118297,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -122815,11 +118339,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -122837,11 +118357,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -122857,8 +118373,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -122870,13 +118386,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -122910,11 +118426,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -122946,8 +118458,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -123038,11 +118550,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -123065,11 +118573,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -123123,7 +118627,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -123150,7 +118654,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -123166,11 +118670,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -123209,11 +118709,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -123260,8 +118756,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -123282,8 +118778,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -123332,7 +118828,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -123397,13 +118893,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -123431,7 +118927,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -123470,6 +118966,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -123477,11 +118978,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -123505,7 +119001,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -123620,11 +119116,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -123695,11 +119187,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -123726,11 +119214,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -123783,7 +119267,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -123799,7 +119287,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -123828,8 +119316,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -123909,8 +119397,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -123927,11 +119415,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -123975,11 +119459,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -124021,11 +119501,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -124043,11 +119519,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -124063,8 +119535,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -124076,13 +119548,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -124116,11 +119588,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -124152,8 +119620,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -124244,11 +119712,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -124271,11 +119735,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -124329,7 +119789,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -124356,7 +119816,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -124372,11 +119832,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -124415,11 +119871,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -124466,8 +119918,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -124488,8 +119940,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -124538,7 +119990,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -124603,13 +120055,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -124637,7 +120089,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -124676,6 +120128,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -124683,11 +120140,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -124711,7 +120163,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -124826,11 +120278,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -124901,11 +120349,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -124932,11 +120376,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -124989,7 +120429,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -125005,7 +120449,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -125034,8 +120478,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -125115,8 +120559,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -125133,11 +120577,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -125181,11 +120621,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -125227,11 +120663,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -125249,11 +120681,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -125269,8 +120697,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -125282,13 +120710,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -125322,11 +120750,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -125358,8 +120782,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -125450,11 +120874,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -125477,11 +120897,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -125535,7 +120951,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -125562,7 +120978,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -125578,11 +120994,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -125621,11 +121033,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -125672,8 +121080,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -125694,8 +121102,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -125744,7 +121152,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -125809,13 +121217,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -125843,7 +121251,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -125882,6 +121290,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -125889,11 +121302,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -125917,7 +121325,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -126032,11 +121440,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -126107,11 +121511,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -126138,11 +121538,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -126195,7 +121591,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -126211,7 +121611,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -126240,8 +121640,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -126321,8 +121721,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -126339,11 +121739,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -126387,11 +121783,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -126433,11 +121825,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -126455,11 +121843,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -126475,8 +121859,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -126488,13 +121872,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -126528,11 +121912,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -126564,8 +121944,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -126656,11 +122036,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -126683,11 +122059,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -126741,7 +122113,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -126768,7 +122140,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -126784,11 +122156,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -126827,11 +122195,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -126878,8 +122242,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -126900,8 +122264,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -126950,7 +122314,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -127015,13 +122379,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -127049,7 +122413,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -127088,6 +122452,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -127095,11 +122464,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -127123,7 +122487,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -127238,11 +122602,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -127313,11 +122673,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -127344,11 +122700,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -127401,7 +122753,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -127417,7 +122773,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -127446,8 +122802,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -127527,8 +122883,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -127545,11 +122901,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -127593,11 +122945,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -127639,11 +122987,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -127661,11 +123005,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -127681,8 +123021,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -127694,13 +123034,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -127734,11 +123074,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -127770,8 +123106,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -127862,11 +123198,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -127889,11 +123221,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -127947,7 +123275,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -127974,7 +123302,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -127990,11 +123318,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -128033,11 +123357,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -128084,8 +123404,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -128106,8 +123426,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -128156,7 +123476,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -128221,13 +123541,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -128255,7 +123575,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -128294,6 +123614,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -128301,11 +123626,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -128329,7 +123649,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -128444,11 +123764,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -128519,11 +123835,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -128550,11 +123862,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -128607,7 +123915,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -128623,7 +123935,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -128652,8 +123964,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -128733,8 +124045,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -128751,11 +124063,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -128799,11 +124107,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -128845,11 +124149,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -128867,11 +124167,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -128887,8 +124183,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -128900,13 +124196,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -128940,11 +124236,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -128976,8 +124268,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -129068,11 +124360,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -129095,11 +124383,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -129153,7 +124437,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -129180,7 +124464,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -129196,11 +124480,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -129239,11 +124519,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -129290,8 +124566,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -129312,8 +124588,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -129362,7 +124638,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -129427,13 +124703,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -129461,7 +124737,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -129500,6 +124776,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -129507,11 +124788,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -129535,7 +124811,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -129650,11 +124926,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -129725,11 +124997,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -129756,11 +125024,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -129813,7 +125077,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -129829,7 +125097,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -129858,8 +125126,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -129939,8 +125207,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -129957,11 +125225,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -130005,11 +125269,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -130051,11 +125311,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -130073,11 +125329,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -130093,8 +125345,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -130106,13 +125358,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -130146,11 +125398,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -130182,8 +125430,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -130274,11 +125522,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -130301,11 +125545,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -130359,7 +125599,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -130386,7 +125626,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -130402,11 +125642,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -130445,11 +125681,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -130496,8 +125728,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -130518,8 +125750,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -130568,7 +125800,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -130633,13 +125865,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -130667,7 +125899,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -130706,6 +125938,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -130713,11 +125950,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -130741,7 +125973,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -130856,11 +126088,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -130931,11 +126159,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -130962,11 +126186,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -131019,7 +126239,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -131035,7 +126259,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -131064,8 +126288,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -131145,8 +126369,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -131163,11 +126387,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -131211,11 +126431,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -131257,11 +126473,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -131279,11 +126491,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -131299,8 +126507,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -131312,13 +126520,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -131352,11 +126560,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -131388,8 +126592,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -131480,11 +126684,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -131507,11 +126707,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -131565,7 +126761,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -131592,7 +126788,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -131608,11 +126804,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -131651,11 +126843,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -131702,8 +126890,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -131724,8 +126912,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -131774,7 +126962,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -131839,13 +127027,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -131873,7 +127061,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -131912,6 +127100,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -131919,11 +127112,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -131947,7 +127135,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -132062,11 +127250,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -132137,11 +127321,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -132168,11 +127348,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -132225,7 +127401,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -132241,7 +127421,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -132270,8 +127450,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -132351,8 +127531,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -132369,11 +127549,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -132417,11 +127593,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -132463,11 +127635,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -132485,11 +127653,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -132505,8 +127669,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -132518,13 +127682,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -132558,11 +127722,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -132594,8 +127754,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -132686,11 +127846,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -132713,11 +127869,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -132771,7 +127923,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -132798,7 +127950,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -132814,11 +127966,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -132857,11 +128005,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -132908,8 +128052,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -132930,8 +128074,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -132980,7 +128124,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -133045,13 +128189,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -133079,7 +128223,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -133118,6 +128262,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -133125,11 +128274,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -133153,7 +128297,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -133268,11 +128412,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -133343,11 +128483,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -133374,11 +128510,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -133431,7 +128563,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -133447,7 +128583,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -133476,8 +128612,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -133557,8 +128693,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -133575,11 +128711,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -133623,11 +128755,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -133669,11 +128797,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -133691,11 +128815,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -133711,8 +128831,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -133724,13 +128844,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -133764,11 +128884,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -133800,8 +128916,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -133892,11 +129008,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -133919,11 +129031,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -133977,7 +129085,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -134004,7 +129112,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -134020,11 +129128,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -134063,11 +129167,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -134114,8 +129214,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -134136,8 +129236,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -134186,7 +129286,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -134251,13 +129351,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -134285,7 +129385,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -134324,6 +129424,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -134331,11 +129436,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -134359,7 +129459,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -134474,11 +129574,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -134549,11 +129645,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -134580,11 +129672,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -134637,7 +129725,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -134653,7 +129745,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -134682,8 +129774,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -134763,8 +129855,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -134781,11 +129873,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -134829,11 +129917,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -134875,11 +129959,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -134897,11 +129977,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -134917,8 +129993,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -134930,13 +130006,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -134970,11 +130046,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -135006,8 +130078,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -135098,11 +130170,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -135125,11 +130193,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -135183,7 +130247,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -135210,7 +130274,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -135226,11 +130290,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -135269,11 +130329,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -135320,8 +130376,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -135342,8 +130398,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -135392,7 +130448,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -135457,13 +130513,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -135491,7 +130547,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -135530,6 +130586,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -135537,11 +130598,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -135565,7 +130621,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -135680,11 +130736,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -135755,11 +130807,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -135786,11 +130834,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -135843,7 +130887,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -135859,7 +130907,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -135888,8 +130936,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -135969,8 +131017,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -135987,11 +131035,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -136035,11 +131079,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -136081,11 +131121,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -136103,11 +131139,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -136123,8 +131155,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -136136,13 +131168,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -136176,11 +131208,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -136212,8 +131240,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -136304,11 +131332,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -136331,11 +131355,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -136389,7 +131409,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -136416,7 +131436,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -136432,11 +131452,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -136475,11 +131491,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -136526,8 +131538,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -136548,8 +131560,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -136598,7 +131610,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -136663,13 +131675,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -136697,7 +131709,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -136736,6 +131748,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -136743,11 +131760,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -136771,7 +131783,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -136886,11 +131898,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -136961,11 +131969,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -136992,11 +131996,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -137049,7 +132049,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -137065,7 +132069,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -137094,8 +132098,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -137175,8 +132179,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -137193,11 +132197,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -137241,11 +132241,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -137287,11 +132283,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -137309,11 +132301,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -137329,8 +132317,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -137342,13 +132330,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -137382,11 +132370,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -137418,8 +132402,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -137510,11 +132494,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -137537,11 +132517,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -137595,7 +132571,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -137622,7 +132598,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -137638,11 +132614,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -137681,11 +132653,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -137732,8 +132700,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -137754,8 +132722,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -137804,7 +132772,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -137869,13 +132837,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -137903,7 +132871,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -137942,6 +132910,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -137949,11 +132922,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -137977,7 +132945,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -138092,11 +133060,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -138167,11 +133131,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -138198,11 +133158,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -138255,7 +133211,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -138271,7 +133231,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -138300,8 +133260,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -138381,8 +133341,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -138399,11 +133359,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -138447,11 +133403,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -138493,11 +133445,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -138515,11 +133463,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -138535,8 +133479,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -138548,13 +133492,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -138588,11 +133532,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -138624,8 +133564,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -138716,11 +133656,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -138743,11 +133679,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -138801,7 +133733,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -138828,7 +133760,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -138844,11 +133776,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -138887,11 +133815,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -138938,8 +133862,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -138960,8 +133884,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -139010,7 +133934,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -139075,13 +133999,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -139109,7 +134033,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -139148,6 +134072,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -139155,11 +134084,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -139183,7 +134107,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -139298,11 +134222,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -139373,11 +134293,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -139404,11 +134320,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -139461,7 +134373,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -139477,7 +134393,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -139506,8 +134422,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -139587,8 +134503,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -139605,11 +134521,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -139653,11 +134565,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -139699,11 +134607,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -139721,11 +134625,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -139741,8 +134641,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -139754,13 +134654,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -139794,11 +134694,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -139830,8 +134726,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -139922,11 +134818,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -139949,11 +134841,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -140007,7 +134895,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -140034,7 +134922,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -140050,11 +134938,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -140093,11 +134977,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -140144,8 +135024,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -140166,8 +135046,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -140216,7 +135096,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -140281,13 +135161,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -140315,7 +135195,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -140354,6 +135234,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -140361,11 +135246,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -140389,7 +135269,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -140504,11 +135384,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -140579,11 +135455,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -140610,11 +135482,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -140667,7 +135535,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -140683,7 +135555,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -140712,8 +135584,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -140793,8 +135665,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -140811,11 +135683,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -140859,11 +135727,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -140905,11 +135769,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -140927,11 +135787,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -140947,8 +135803,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -140960,13 +135816,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -141000,11 +135856,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -141036,8 +135888,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -141128,11 +135980,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -141155,11 +136003,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -141213,7 +136057,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -141240,7 +136084,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -141256,11 +136100,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -141299,11 +136139,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -141350,8 +136186,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -141372,8 +136208,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -141422,7 +136258,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -141487,13 +136323,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -141521,7 +136357,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -141560,6 +136396,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -141567,11 +136408,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -141595,7 +136431,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -141710,11 +136546,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -141785,11 +136617,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -141816,11 +136644,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -141873,7 +136697,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -141889,7 +136717,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -141918,8 +136746,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -141999,8 +136827,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -142017,11 +136845,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -142065,11 +136889,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -142111,11 +136931,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -142133,11 +136949,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -142153,8 +136965,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -142166,13 +136978,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -142206,11 +137018,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -142242,8 +137050,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -142334,11 +137142,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -142361,11 +137165,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -142419,7 +137219,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -142446,7 +137246,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -142462,11 +137262,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -142505,11 +137301,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -142556,8 +137348,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -142578,8 +137370,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -142628,7 +137420,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -142693,13 +137485,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -142727,7 +137519,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -142766,6 +137558,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -142773,11 +137570,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -142801,7 +137593,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -142916,11 +137708,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -142991,11 +137779,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -143022,11 +137806,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -143079,7 +137859,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -143095,7 +137879,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -143124,8 +137908,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -143205,8 +137989,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -143223,11 +138007,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -143271,11 +138051,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -143317,11 +138093,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -143339,11 +138111,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -143359,8 +138127,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -143372,13 +138140,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -143412,11 +138180,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -143448,8 +138212,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -143540,11 +138304,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -143567,11 +138327,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -143625,7 +138381,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -143652,7 +138408,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -143668,11 +138424,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -143711,11 +138463,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -143762,8 +138510,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -143784,8 +138532,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -143834,7 +138582,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -143899,13 +138647,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -143933,7 +138681,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -143972,6 +138720,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -143979,11 +138732,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -144007,7 +138755,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -144122,11 +138870,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -144197,11 +138941,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -144228,11 +138968,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -144285,7 +139021,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -144301,7 +139041,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -144330,8 +139070,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -144411,8 +139151,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -144429,11 +139169,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -144477,11 +139213,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -144523,11 +139255,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -144545,11 +139273,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -144565,8 +139289,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -144578,13 +139302,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -144618,11 +139342,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -144654,8 +139374,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -144746,11 +139466,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -144773,11 +139489,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -144831,7 +139543,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -144858,7 +139570,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -144874,11 +139586,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -144917,11 +139625,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -144968,8 +139672,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -144990,8 +139694,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -145040,7 +139744,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -145105,13 +139809,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -145139,7 +139843,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -145178,6 +139882,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -145185,11 +139894,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -145213,7 +139917,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -145328,11 +140032,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -145403,11 +140103,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -145434,11 +140130,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -145491,7 +140183,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -145507,7 +140203,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -145536,8 +140232,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -145617,8 +140313,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -145635,11 +140331,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -145683,11 +140375,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -145729,11 +140417,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -145751,11 +140435,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -145771,8 +140451,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -145784,13 +140464,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -145824,11 +140504,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -145860,8 +140536,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -145952,11 +140628,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -145979,11 +140651,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -146037,7 +140705,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -146064,7 +140732,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -146080,11 +140748,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -146123,11 +140787,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -146174,8 +140834,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -146196,8 +140856,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -146246,7 +140906,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -146311,13 +140971,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -146345,7 +141005,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -146384,6 +141044,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -146391,11 +141056,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -146419,7 +141079,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -146534,11 +141194,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -146609,11 +141265,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -146640,11 +141292,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -146697,7 +141345,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -146713,7 +141365,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -146742,8 +141394,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -146823,8 +141475,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -146841,11 +141493,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -146889,11 +141537,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -146935,11 +141579,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -146957,11 +141597,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -146977,8 +141613,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -146990,13 +141626,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -147030,11 +141666,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -147066,8 +141698,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -147158,11 +141790,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -147185,11 +141813,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -147243,7 +141867,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -147270,7 +141894,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -147286,11 +141910,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -147329,11 +141949,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -147380,8 +141996,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -147402,8 +142018,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -147452,7 +142068,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -147517,13 +142133,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -147551,7 +142167,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -147590,6 +142206,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -147597,11 +142218,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -147625,7 +142241,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -147740,11 +142356,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -147815,11 +142427,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -147846,11 +142454,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -147903,7 +142507,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -147919,7 +142527,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -147948,8 +142556,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -148029,8 +142637,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -148047,11 +142655,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -148095,11 +142699,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -148141,11 +142741,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -148163,11 +142759,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -148183,8 +142775,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -148196,13 +142788,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -148236,11 +142828,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -148272,8 +142860,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -148364,11 +142952,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -148391,11 +142975,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -148449,7 +143029,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -148476,7 +143056,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -148492,11 +143072,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -148535,11 +143111,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -148586,8 +143158,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -148608,8 +143180,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -148658,7 +143230,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -148723,13 +143295,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -148757,7 +143329,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -148796,6 +143368,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -148803,11 +143380,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -148831,7 +143403,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -148946,11 +143518,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -149021,11 +143589,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -149052,11 +143616,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -149109,7 +143669,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -149125,7 +143689,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -149154,8 +143718,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -149235,8 +143799,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -149253,11 +143817,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -149301,11 +143861,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -149347,11 +143903,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -149369,11 +143921,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -149389,8 +143937,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -149402,13 +143950,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -149442,11 +143990,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -149478,8 +144022,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -149570,11 +144114,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -149597,11 +144137,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -149655,7 +144191,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -149682,7 +144218,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -149698,11 +144234,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -149741,11 +144273,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -149792,8 +144320,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -149814,8 +144342,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -149864,7 +144392,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -149929,13 +144457,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -149963,7 +144491,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -150002,6 +144530,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -150009,11 +144542,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -150037,7 +144565,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -150152,11 +144680,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -150227,11 +144751,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -150258,11 +144778,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -150315,7 +144831,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -150331,7 +144851,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -150360,8 +144880,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -150441,8 +144961,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -150459,11 +144979,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -150507,11 +145023,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -150553,11 +145065,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -150575,11 +145083,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -150595,8 +145099,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -150608,13 +145112,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -150648,11 +145152,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -150684,8 +145184,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -150776,11 +145276,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -150803,11 +145299,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -150861,7 +145353,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -150888,7 +145380,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -150904,11 +145396,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -150947,11 +145435,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -150998,8 +145482,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -151020,8 +145504,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -151070,7 +145554,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -151135,13 +145619,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -151169,7 +145653,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -151208,6 +145692,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -151215,11 +145704,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -151243,7 +145727,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -151358,11 +145842,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -151433,11 +145913,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -151464,11 +145940,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -151521,7 +145993,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -151537,7 +146013,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -151566,8 +146042,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -151647,8 +146123,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -151665,11 +146141,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -151713,11 +146185,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -151759,11 +146227,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -151781,11 +146245,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -151801,8 +146261,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -151814,13 +146274,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -151854,11 +146314,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -151890,8 +146346,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -151982,11 +146438,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -152009,11 +146461,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -152067,7 +146515,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -152094,7 +146542,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -152110,11 +146558,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -152153,11 +146597,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -152204,8 +146644,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -152226,8 +146666,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -152276,7 +146716,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -152341,13 +146781,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -152375,7 +146815,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -152414,6 +146854,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -152421,11 +146866,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -152449,7 +146889,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -152564,11 +147004,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -152639,11 +147075,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -152670,11 +147102,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -152727,7 +147155,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -152743,7 +147175,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -152772,8 +147204,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -152853,8 +147285,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -152871,11 +147303,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -152919,11 +147347,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -152965,11 +147389,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -152987,11 +147407,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -153007,8 +147423,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -153020,13 +147436,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -153060,11 +147476,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -153096,8 +147508,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -153188,11 +147600,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -153215,11 +147623,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -153273,7 +147677,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -153300,7 +147704,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -153316,11 +147720,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -153359,11 +147759,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -153410,8 +147806,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -153432,8 +147828,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -153482,7 +147878,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -153547,13 +147943,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -153581,7 +147977,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -153620,6 +148016,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -153627,11 +148028,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -153655,7 +148051,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -153770,11 +148166,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -153845,11 +148237,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -153876,11 +148264,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -153933,7 +148317,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -153949,7 +148337,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -153978,8 +148366,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -154059,8 +148447,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -154077,11 +148465,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -154125,11 +148509,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -154171,11 +148551,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -154193,11 +148569,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -154213,8 +148585,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -154226,13 +148598,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -154266,11 +148638,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -154302,8 +148670,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -154394,11 +148762,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -154421,11 +148785,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -154479,7 +148839,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -154506,7 +148866,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -154522,11 +148882,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -154565,11 +148921,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -154616,8 +148968,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -154638,8 +148990,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -154688,7 +149040,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -154753,13 +149105,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -154787,7 +149139,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -154826,6 +149178,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -154833,11 +149190,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -154861,7 +149213,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -154976,11 +149328,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -155051,11 +149399,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -155082,11 +149426,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -155139,7 +149479,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -155155,7 +149499,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -155184,8 +149528,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -155265,8 +149609,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -155283,11 +149627,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -155331,11 +149671,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -155377,11 +149713,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -155399,11 +149731,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -155419,8 +149747,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -155432,13 +149760,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -155472,11 +149800,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -155508,8 +149832,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -155600,11 +149924,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -155627,11 +149947,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -155685,7 +150001,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -155712,7 +150028,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -155728,11 +150044,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -155771,11 +150083,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -155822,8 +150130,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -155844,8 +150152,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -155894,7 +150202,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -155959,13 +150267,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -155993,7 +150301,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -156032,6 +150340,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -156039,11 +150352,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -156067,7 +150375,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -156182,11 +150490,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -156257,11 +150561,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -156288,11 +150588,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -156345,7 +150641,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -156361,7 +150661,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -156390,8 +150690,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -156471,8 +150771,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -156489,11 +150789,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -156537,11 +150833,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -156583,11 +150875,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -156605,11 +150893,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -156625,8 +150909,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -156638,13 +150922,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -156678,11 +150962,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -156714,8 +150994,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -156806,11 +151086,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -156833,11 +151109,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -156891,7 +151163,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -156918,7 +151190,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -156934,11 +151206,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -156977,11 +151245,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -157028,8 +151292,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -157050,8 +151314,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -157100,7 +151364,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -157165,13 +151429,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -157199,7 +151463,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -157238,6 +151502,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -157245,11 +151514,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -157273,7 +151537,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -157388,11 +151652,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -157463,11 +151723,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -157494,11 +151750,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -157551,7 +151803,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -157567,7 +151823,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -157596,8 +151852,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -157677,8 +151933,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -157695,11 +151951,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -157743,11 +151995,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -157789,11 +152037,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -157811,11 +152055,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -157831,8 +152071,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -157844,13 +152084,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -157884,11 +152124,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -157920,8 +152156,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -158012,11 +152248,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -158039,11 +152271,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -158097,7 +152325,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -158124,7 +152352,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -158140,11 +152368,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -158183,11 +152407,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -158234,8 +152454,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -158256,8 +152476,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -158306,7 +152526,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -158371,13 +152591,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -158405,7 +152625,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -158444,6 +152664,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -158451,11 +152676,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -158479,7 +152699,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -158594,11 +152814,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -158669,11 +152885,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -158700,11 +152912,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -158757,7 +152965,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -158773,7 +152985,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -158802,8 +153014,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -158883,8 +153095,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -158901,11 +153113,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -158949,11 +153157,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -158995,11 +153199,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -159017,11 +153217,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -159037,8 +153233,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -159050,13 +153246,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -159090,11 +153286,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -159126,8 +153318,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -159218,11 +153410,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -159245,11 +153433,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -159303,7 +153487,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -159330,7 +153514,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -159346,11 +153530,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -159389,11 +153569,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -159440,8 +153616,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -159462,8 +153638,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -159512,7 +153688,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -159577,13 +153753,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -159611,7 +153787,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -159650,6 +153826,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -159657,11 +153838,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -159685,7 +153861,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -159800,11 +153976,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -159875,11 +154047,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -159906,11 +154074,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -159963,7 +154127,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -159979,7 +154147,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -160008,8 +154176,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -160089,8 +154257,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -160107,11 +154275,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -160155,11 +154319,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -160201,11 +154361,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -160223,11 +154379,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -160243,8 +154395,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -160256,13 +154408,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -160296,11 +154448,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -160332,8 +154480,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -160424,11 +154572,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -160451,11 +154595,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -160509,7 +154649,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -160536,7 +154676,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -160552,11 +154692,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -160595,11 +154731,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -160646,8 +154778,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -160668,8 +154800,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -160718,7 +154850,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -160783,13 +154915,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -160817,7 +154949,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -160856,6 +154988,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -160863,11 +155000,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -160891,7 +155023,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -161006,11 +155138,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -161081,11 +155209,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -161112,11 +155236,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -161169,7 +155289,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -161185,7 +155309,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -161214,8 +155338,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -161295,8 +155419,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -161313,11 +155437,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -161361,11 +155481,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -161407,11 +155523,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -161429,11 +155541,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -161449,8 +155557,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -161462,13 +155570,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -161502,11 +155610,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -161538,8 +155642,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -161630,11 +155734,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -161657,11 +155757,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -161715,7 +155811,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -161742,7 +155838,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -161758,11 +155854,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -161801,11 +155893,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -161852,8 +155940,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -161874,8 +155962,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -161924,7 +156012,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -161989,13 +156077,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -162023,7 +156111,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -162062,6 +156150,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -162069,11 +156162,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -162097,7 +156185,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -162212,11 +156300,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -162287,11 +156371,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -162318,11 +156398,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -162375,7 +156451,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -162391,7 +156471,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -162420,8 +156500,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -162501,8 +156581,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -162519,11 +156599,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -162567,11 +156643,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -162613,11 +156685,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -162635,11 +156703,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -162655,8 +156719,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -162668,13 +156732,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -162708,11 +156772,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -162744,8 +156804,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -162836,11 +156896,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -162863,11 +156919,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -162921,7 +156973,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -162948,7 +157000,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -162964,11 +157016,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -163007,11 +157055,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -163058,8 +157102,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -163080,8 +157124,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -163130,7 +157174,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -163195,13 +157239,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -163229,7 +157273,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -163268,6 +157312,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -163275,11 +157324,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -163303,7 +157347,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -163418,11 +157462,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -163493,11 +157533,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -163524,11 +157560,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -163581,7 +157613,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -163597,7 +157633,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -163626,8 +157662,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -163707,8 +157743,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -163725,11 +157761,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -163773,11 +157805,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -163819,11 +157847,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -163841,11 +157865,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -163861,8 +157881,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -163874,13 +157894,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -163914,11 +157934,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -163950,8 +157966,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -164042,11 +158058,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -164069,11 +158081,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -164127,7 +158135,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -164154,7 +158162,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -164170,11 +158178,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -164213,11 +158217,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -164264,8 +158264,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -164286,8 +158286,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -164336,7 +158336,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -164401,13 +158401,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -164435,7 +158435,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -164474,6 +158474,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -164481,11 +158486,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -164509,7 +158509,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -164624,11 +158624,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -164699,11 +158695,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -164730,11 +158722,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -164787,7 +158775,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -164803,7 +158795,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -164832,8 +158824,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -164913,8 +158905,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -164931,11 +158923,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -164979,11 +158967,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -165025,11 +159009,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -165047,11 +159027,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -165067,8 +159043,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -165080,13 +159056,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -165120,11 +159096,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -165156,8 +159128,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -165248,11 +159220,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -165275,11 +159243,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -165333,7 +159297,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -165360,7 +159324,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -165376,11 +159340,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -165419,11 +159379,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -165470,8 +159426,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -165492,8 +159448,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -165542,7 +159498,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -165607,13 +159563,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -165641,7 +159597,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -165680,6 +159636,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -165687,11 +159648,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -165715,7 +159671,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -165830,11 +159786,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -165905,11 +159857,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -165936,11 +159884,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -165993,7 +159937,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -166009,7 +159957,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -166038,8 +159986,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -166119,8 +160067,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -166137,11 +160085,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -166185,11 +160129,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -166231,11 +160171,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -166253,11 +160189,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -166273,8 +160205,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -166286,13 +160218,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -166326,11 +160258,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -166362,8 +160290,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -166454,11 +160382,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -166481,11 +160405,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -166539,7 +160459,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -166566,7 +160486,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -166582,11 +160502,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -166625,11 +160541,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -166676,8 +160588,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -166698,8 +160610,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -166748,7 +160660,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -166813,13 +160725,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -166847,7 +160759,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -166886,6 +160798,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -166893,11 +160810,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -166921,7 +160833,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -167036,11 +160948,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -167111,11 +161019,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -167142,11 +161046,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -167199,7 +161099,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -167215,7 +161119,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -167244,8 +161148,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -167325,8 +161229,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -167343,11 +161247,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -167391,11 +161291,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -167437,11 +161333,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -167459,11 +161351,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -167479,8 +161367,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -167492,13 +161380,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -167532,11 +161420,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -167568,8 +161452,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -167660,11 +161544,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -167687,11 +161567,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -167745,7 +161621,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -167772,7 +161648,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -167788,11 +161664,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -167831,11 +161703,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -167882,8 +161750,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -167904,8 +161772,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -167954,7 +161822,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -168019,13 +161887,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -168053,7 +161921,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -168092,6 +161960,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -168099,11 +161972,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -168127,7 +161995,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -168242,11 +162110,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -168317,11 +162181,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -168348,11 +162208,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -168405,7 +162261,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -168421,7 +162281,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -168450,8 +162310,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -168531,8 +162391,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -168549,11 +162409,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -168597,11 +162453,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -168643,11 +162495,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -168665,11 +162513,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -168685,8 +162529,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -168698,13 +162542,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -168738,11 +162582,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -168774,8 +162614,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -168866,11 +162706,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -168893,11 +162729,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -168951,7 +162783,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -168978,7 +162810,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -168994,11 +162826,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -169037,11 +162865,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -169088,8 +162912,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -169110,8 +162934,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -169160,7 +162984,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -169225,13 +163049,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -169259,7 +163083,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -169298,6 +163122,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -169305,11 +163134,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -169333,7 +163157,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -169448,11 +163272,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -169523,11 +163343,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -169554,11 +163370,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -169611,7 +163423,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -169627,7 +163443,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -169656,8 +163472,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -169737,8 +163553,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -169755,11 +163571,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -169803,11 +163615,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -169849,11 +163657,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -169871,11 +163675,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -169891,8 +163691,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -169904,13 +163704,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -169944,11 +163744,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -169980,8 +163776,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -170072,11 +163868,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -170099,11 +163891,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -170157,7 +163945,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -170184,7 +163972,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -170200,11 +163988,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -170243,11 +164027,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -170294,8 +164074,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -170316,8 +164096,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -170366,7 +164146,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -170431,13 +164211,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -170465,7 +164245,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -170504,6 +164284,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -170511,11 +164296,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -170539,7 +164319,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -170654,11 +164434,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -170729,11 +164505,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -170760,11 +164532,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -170817,7 +164585,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -170833,7 +164605,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -170862,8 +164634,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -170943,8 +164715,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -170961,11 +164733,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -171009,11 +164777,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -171055,11 +164819,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -171077,11 +164837,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -171097,8 +164853,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -171110,13 +164866,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -171150,11 +164906,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -171186,8 +164938,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -171278,11 +165030,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -171305,11 +165053,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -171363,7 +165107,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -171390,7 +165134,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -171406,11 +165150,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -171449,11 +165189,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -171500,8 +165236,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -171522,8 +165258,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -171572,7 +165308,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -171637,13 +165373,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -171671,7 +165407,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -171710,6 +165446,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -171717,11 +165458,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -171745,7 +165481,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -171860,11 +165596,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -171935,11 +165667,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -171966,11 +165694,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -172023,7 +165747,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -172039,7 +165767,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -172068,8 +165796,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -172149,8 +165877,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -172167,11 +165895,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -172215,11 +165939,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -172261,11 +165981,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -172283,11 +165999,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -172303,8 +166015,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -172316,13 +166028,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -172356,11 +166068,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -172392,8 +166100,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -172484,11 +166192,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -172511,11 +166215,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -172569,7 +166269,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -172596,7 +166296,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -172612,11 +166312,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -172655,11 +166351,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -172706,8 +166398,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -172728,8 +166420,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -172778,7 +166470,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -172843,13 +166535,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -172877,7 +166569,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -172916,6 +166608,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -172923,11 +166620,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -172951,7 +166643,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -173066,11 +166758,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -173141,11 +166829,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -173172,11 +166856,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -173229,7 +166909,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -173245,7 +166929,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -173274,8 +166958,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -173355,8 +167039,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -173373,11 +167057,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -173421,11 +167101,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -173467,11 +167143,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -173489,11 +167161,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -173509,8 +167177,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -173522,13 +167190,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -173562,11 +167230,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -173598,8 +167262,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -173690,11 +167354,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -173717,11 +167377,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -173775,7 +167431,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -173802,7 +167458,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -173818,11 +167474,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -173861,11 +167513,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -173912,8 +167560,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -173934,8 +167582,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -173984,7 +167632,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -174049,13 +167697,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -174083,7 +167731,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -174122,6 +167770,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -174129,11 +167782,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -174157,7 +167805,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -174272,11 +167920,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -174347,11 +167991,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -174378,11 +168018,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -174435,7 +168071,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -174451,7 +168091,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -174480,8 +168120,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -174561,8 +168201,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -174579,11 +168219,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -174627,11 +168263,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -174673,11 +168305,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -174695,11 +168323,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -174715,8 +168339,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -174728,13 +168352,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -174768,11 +168392,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -174804,8 +168424,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -174896,11 +168516,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -174923,11 +168539,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -174981,7 +168593,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -175008,7 +168620,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -175024,11 +168636,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -175067,11 +168675,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -175118,8 +168722,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -175140,8 +168744,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -175190,7 +168794,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -175255,13 +168859,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -175289,7 +168893,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -175328,6 +168932,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -175335,11 +168944,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -175363,7 +168967,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -175478,11 +169082,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -175553,11 +169153,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -175584,11 +169180,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -175641,7 +169233,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -175657,7 +169253,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -175686,8 +169282,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -175767,8 +169363,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -175785,11 +169381,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -175833,11 +169425,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -175879,11 +169467,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -175901,11 +169485,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -175921,8 +169501,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -175934,13 +169514,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -175974,11 +169554,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -176010,8 +169586,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -176102,11 +169678,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -176129,11 +169701,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -176187,7 +169755,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -176214,7 +169782,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -176230,11 +169798,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -176273,11 +169837,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -176324,8 +169884,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -176346,8 +169906,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -176396,7 +169956,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -176461,13 +170021,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -176495,7 +170055,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -176534,6 +170094,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -176541,11 +170106,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -176569,7 +170129,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -176684,11 +170244,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -176759,11 +170315,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -176790,11 +170342,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -176847,7 +170395,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -176863,7 +170415,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -176892,8 +170444,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -176973,8 +170525,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -176991,11 +170543,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -177039,11 +170587,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -177085,11 +170629,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -177107,11 +170647,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -177127,8 +170663,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -177140,13 +170676,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -177180,11 +170716,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -177216,8 +170748,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -177308,11 +170840,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -177335,11 +170863,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -177393,7 +170917,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -177420,7 +170944,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -177436,11 +170960,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -177479,11 +170999,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -177530,8 +171046,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -177552,8 +171068,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -177602,7 +171118,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -177667,13 +171183,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -177701,7 +171217,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -177740,6 +171256,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -177747,11 +171268,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -177775,7 +171291,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -177890,11 +171406,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -177965,11 +171477,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -177996,11 +171504,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -178053,7 +171557,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -178069,7 +171577,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -178098,8 +171606,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -178179,8 +171687,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -178197,11 +171705,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -178245,11 +171749,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -178291,11 +171791,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -178313,11 +171809,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -178333,8 +171825,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -178346,13 +171838,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -178386,11 +171878,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -178422,8 +171910,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -178514,11 +172002,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -178541,11 +172025,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -178599,7 +172079,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -178626,7 +172106,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -178642,11 +172122,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -178685,11 +172161,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -178736,8 +172208,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -178758,8 +172230,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -178808,7 +172280,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -178873,13 +172345,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -178907,7 +172379,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -178946,6 +172418,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -178953,11 +172430,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -178981,7 +172453,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -179096,11 +172568,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -179171,11 +172639,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -179202,11 +172666,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -179259,7 +172719,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -179275,7 +172739,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -179304,8 +172768,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -179385,8 +172849,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -179403,11 +172867,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -179451,11 +172911,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -179497,11 +172953,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -179519,11 +172971,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -179539,8 +172987,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -179552,13 +173000,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -179592,11 +173040,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -179628,8 +173072,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -179720,11 +173164,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -179747,11 +173187,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -179805,7 +173241,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -179832,7 +173268,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -179848,11 +173284,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -179891,11 +173323,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -179942,8 +173370,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -179964,8 +173392,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -180014,7 +173442,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -180079,13 +173507,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -180113,7 +173541,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -180152,6 +173580,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -180159,11 +173592,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -180187,7 +173615,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -180302,11 +173730,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -180377,11 +173801,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -180408,11 +173828,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -180465,7 +173881,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -180481,7 +173901,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -180510,8 +173930,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -180591,8 +174011,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -180609,11 +174029,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -180657,11 +174073,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -180703,11 +174115,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -180725,11 +174133,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -180745,8 +174149,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -180758,13 +174162,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -180798,11 +174202,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -180834,8 +174234,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -180926,11 +174326,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -180953,11 +174349,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -181011,7 +174403,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -181038,7 +174430,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -181054,11 +174446,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -181097,11 +174485,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -181148,8 +174532,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -181170,8 +174554,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -181220,7 +174604,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -181285,13 +174669,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -181319,7 +174703,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -181358,6 +174742,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -181365,11 +174754,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -181393,7 +174777,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -181508,11 +174892,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -181583,11 +174963,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -181614,11 +174990,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -181671,7 +175043,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -181687,7 +175063,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -181716,8 +175092,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -181797,8 +175173,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -181815,11 +175191,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -181863,11 +175235,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -181909,11 +175277,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -181931,11 +175295,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -181951,8 +175311,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -181964,13 +175324,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -182004,11 +175364,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -182040,8 +175396,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -182132,11 +175488,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -182159,11 +175511,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -182217,7 +175565,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -182244,7 +175592,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -182260,11 +175608,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -182303,11 +175647,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -182354,8 +175694,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -182376,8 +175716,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -182426,7 +175766,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -182491,13 +175831,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -182525,7 +175865,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -182564,6 +175904,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -182571,11 +175916,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -182599,7 +175939,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -182714,11 +176054,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -182789,11 +176125,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -182820,11 +176152,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -182877,7 +176205,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -182893,7 +176225,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -182922,8 +176254,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -183003,8 +176335,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -183021,11 +176353,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -183069,11 +176397,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -183115,11 +176439,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -183137,11 +176457,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -183157,8 +176473,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -183170,13 +176486,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -183210,11 +176526,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -183246,8 +176558,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -183338,11 +176650,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -183365,11 +176673,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -183423,7 +176727,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -183450,7 +176754,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -183466,11 +176770,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -183509,11 +176809,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -183560,8 +176856,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -183582,8 +176878,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -183632,7 +176928,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -183697,13 +176993,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -183731,7 +177027,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -183770,6 +177066,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -183777,11 +177078,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -183805,7 +177101,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -183920,11 +177216,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -183995,11 +177287,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -184026,11 +177314,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -184083,7 +177367,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -184099,7 +177387,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -184128,8 +177416,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -184209,8 +177497,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -184227,11 +177515,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -184275,11 +177559,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -184321,11 +177601,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -184343,11 +177619,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -184363,8 +177635,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -184376,13 +177648,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -184416,11 +177688,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -184452,8 +177720,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -184544,11 +177812,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -184571,11 +177835,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -184629,7 +177889,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -184656,7 +177916,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -184672,11 +177932,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -184715,11 +177971,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -184766,8 +178018,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -184788,8 +178040,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -184838,7 +178090,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -184903,13 +178155,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -184937,7 +178189,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -184976,6 +178228,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -184983,11 +178240,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -185011,7 +178263,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -185126,11 +178378,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -185201,11 +178449,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -185232,11 +178476,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -185289,7 +178529,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -185305,7 +178549,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -185334,8 +178578,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -185415,8 +178659,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -185433,11 +178677,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -185481,11 +178721,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -185527,11 +178763,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -185549,11 +178781,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -185569,8 +178797,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -185582,13 +178810,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -185622,11 +178850,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -185658,8 +178882,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -185750,11 +178974,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -185777,11 +178997,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -185835,7 +179051,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -185862,7 +179078,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -185878,11 +179094,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -185921,11 +179133,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -185972,8 +179180,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -185994,8 +179202,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -186044,7 +179252,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -186109,13 +179317,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -186143,7 +179351,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -186182,6 +179390,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -186189,11 +179402,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -186217,7 +179425,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -186332,11 +179540,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -186407,11 +179611,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -186438,11 +179638,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -186495,7 +179691,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -186511,7 +179711,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -186540,8 +179740,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -186621,8 +179821,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -186639,11 +179839,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -186687,11 +179883,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -186733,11 +179925,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -186755,11 +179943,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -186775,8 +179959,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -186788,13 +179972,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -186828,11 +180012,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -186864,8 +180044,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -186956,11 +180136,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -186983,11 +180159,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -187041,7 +180213,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -187068,7 +180240,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -187084,11 +180256,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -187127,11 +180295,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -187178,8 +180342,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -187200,8 +180364,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -187250,7 +180414,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -187315,13 +180479,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -187349,7 +180513,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -187388,6 +180552,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -187395,11 +180564,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -187423,7 +180587,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -187538,11 +180702,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -187613,11 +180773,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -187644,11 +180800,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -187701,7 +180853,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -187717,7 +180873,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -187746,8 +180902,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -187827,8 +180983,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -187845,11 +181001,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -187893,11 +181045,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -187939,11 +181087,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -187961,11 +181105,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -187981,8 +181121,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -187994,13 +181134,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -188034,11 +181174,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -188070,8 +181206,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -188162,11 +181298,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -188189,11 +181321,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -188247,7 +181375,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -188274,7 +181402,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -188290,11 +181418,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -188333,11 +181457,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -188384,8 +181504,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -188406,8 +181526,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -188456,7 +181576,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -188521,13 +181641,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -188555,7 +181675,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -188594,6 +181714,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -188601,11 +181726,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -188629,7 +181749,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -188744,11 +181864,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -188819,11 +181935,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -188850,11 +181962,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -188907,7 +182015,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -188923,7 +182035,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -188952,8 +182064,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -189033,8 +182145,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -189051,11 +182163,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -189099,11 +182207,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -189145,11 +182249,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -189167,11 +182267,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -189187,8 +182283,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -189200,13 +182296,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -189240,11 +182336,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -189276,8 +182368,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -189368,11 +182460,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -189395,11 +182483,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -189453,7 +182537,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -189480,7 +182564,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -189496,11 +182580,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -189539,11 +182619,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -189590,8 +182666,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -189612,8 +182688,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -189662,7 +182738,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -189727,13 +182803,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -189761,7 +182837,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -189800,6 +182876,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -189807,11 +182888,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -189835,7 +182911,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -189950,11 +183026,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -190025,11 +183097,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -190056,11 +183124,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -190113,7 +183177,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -190129,7 +183197,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -190158,8 +183226,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -190239,8 +183307,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -190257,11 +183325,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -190305,11 +183369,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -190351,11 +183411,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -190373,11 +183429,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -190393,8 +183445,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -190406,13 +183458,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -190446,11 +183498,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -190482,8 +183530,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -190574,11 +183622,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -190601,11 +183645,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -190659,7 +183699,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -190686,7 +183726,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -190702,11 +183742,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -190745,11 +183781,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -190796,8 +183828,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -190818,8 +183850,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -190868,7 +183900,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -190933,13 +183965,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -190967,7 +183999,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -191006,6 +184038,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -191013,11 +184050,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -191041,7 +184073,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -191156,11 +184188,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -191231,11 +184259,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -191262,11 +184286,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -191319,7 +184339,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -191335,7 +184359,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -191364,8 +184388,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -191445,8 +184469,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -191463,11 +184487,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -191511,11 +184531,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -191557,11 +184573,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -191579,11 +184591,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -191599,8 +184607,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -191612,13 +184620,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -191652,11 +184660,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -191688,8 +184692,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -191780,11 +184784,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -191807,11 +184807,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -191865,7 +184861,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -191892,7 +184888,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -191908,11 +184904,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -191951,11 +184943,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -192002,8 +184990,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -192024,8 +185012,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -192074,7 +185062,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -192139,13 +185127,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -192173,7 +185161,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -192212,6 +185200,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -192219,11 +185212,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -192247,7 +185235,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -192362,11 +185350,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -192437,11 +185421,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -192468,11 +185448,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -192525,7 +185501,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -192541,7 +185521,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -192570,8 +185550,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -192651,8 +185631,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -192669,11 +185649,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -192717,11 +185693,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -192763,11 +185735,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -192785,11 +185753,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -192805,8 +185769,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -192818,13 +185782,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -192858,11 +185822,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -192894,8 +185854,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -192986,11 +185946,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -193013,11 +185969,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -193071,7 +186023,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -193098,7 +186050,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -193114,11 +186066,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -193157,11 +186105,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -193208,8 +186152,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -193230,8 +186174,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -193280,7 +186224,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -193345,13 +186289,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -193379,7 +186323,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -193418,6 +186362,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -193425,11 +186374,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -193453,7 +186397,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -193568,11 +186512,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -193643,11 +186583,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -193674,11 +186610,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -193731,7 +186663,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -193747,7 +186683,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -193776,8 +186712,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -193857,8 +186793,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -193875,11 +186811,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -193923,11 +186855,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -193969,11 +186897,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -193991,11 +186915,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -194011,8 +186931,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -194024,13 +186944,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -194064,11 +186984,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -194100,8 +187016,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -194192,11 +187108,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -194219,11 +187131,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -194277,7 +187185,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -194304,7 +187212,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -194320,11 +187228,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -194363,11 +187267,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -194414,8 +187314,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -194436,8 +187336,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -194486,7 +187386,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -194551,13 +187451,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -194585,7 +187485,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -194624,6 +187524,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -194631,11 +187536,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -194659,7 +187559,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -194774,11 +187674,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -194849,11 +187745,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -194880,11 +187772,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -194937,7 +187825,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -194953,7 +187845,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -194982,8 +187874,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -195063,8 +187955,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -195081,11 +187973,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -195129,11 +188017,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -195175,11 +188059,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -195197,11 +188077,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -195217,8 +188093,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -195230,13 +188106,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -195270,11 +188146,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -195306,8 +188178,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -195398,11 +188270,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -195425,11 +188293,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -195483,7 +188347,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -195510,7 +188374,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -195526,11 +188390,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -195569,11 +188429,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -195620,8 +188476,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -195642,8 +188498,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -195692,7 +188548,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -195757,13 +188613,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -195791,7 +188647,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -195830,6 +188686,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -195837,11 +188698,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -195865,7 +188721,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -195980,11 +188836,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -196055,11 +188907,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -196086,11 +188934,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -196143,7 +188987,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -196159,7 +189007,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -196188,8 +189036,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -196269,8 +189117,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -196287,11 +189135,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -196335,11 +189179,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -196381,11 +189221,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -196403,11 +189239,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -196423,8 +189255,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -196436,13 +189268,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -196476,11 +189308,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -196512,8 +189340,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -196604,11 +189432,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -196631,11 +189455,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -196689,7 +189509,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -196716,7 +189536,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -196732,11 +189552,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -196775,11 +189591,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -196826,8 +189638,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -196848,8 +189660,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -196898,7 +189710,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -196963,13 +189775,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -196997,7 +189809,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -197036,6 +189848,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -197043,11 +189860,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -197071,7 +189883,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -197186,11 +189998,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -197261,11 +190069,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -197292,11 +190096,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -197349,7 +190149,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -197365,7 +190169,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -197394,8 +190198,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -197475,8 +190279,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -197493,11 +190297,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -197541,11 +190341,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -197587,11 +190383,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -197609,11 +190401,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -197629,8 +190417,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -197642,13 +190430,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -197682,11 +190470,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -197718,8 +190502,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -197810,11 +190594,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -197837,11 +190617,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -197895,7 +190671,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -197922,7 +190698,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -197938,11 +190714,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -197981,11 +190753,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -198032,8 +190800,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -198054,8 +190822,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -198104,7 +190872,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -198169,13 +190937,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -198203,7 +190971,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -198242,6 +191010,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -198249,11 +191022,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -198277,7 +191045,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -198392,11 +191160,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -198467,11 +191231,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -198498,11 +191258,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -198555,7 +191311,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -198571,7 +191331,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -198600,8 +191360,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -198681,8 +191441,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -198699,11 +191459,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -198747,11 +191503,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -198793,11 +191545,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -198815,11 +191563,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -198835,8 +191579,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -198848,13 +191592,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -198888,11 +191632,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -198924,8 +191664,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -199016,11 +191756,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -199043,11 +191779,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -199101,7 +191833,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -199128,7 +191860,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -199144,11 +191876,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -199187,11 +191915,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -199238,8 +191962,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -199260,8 +191984,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -199310,7 +192034,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -199375,13 +192099,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -199409,7 +192133,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -199448,6 +192172,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -199455,11 +192184,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -199483,7 +192207,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -199598,11 +192322,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -199673,11 +192393,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -199704,11 +192420,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -199761,7 +192473,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -199777,7 +192493,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -199806,8 +192522,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -199887,8 +192603,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -199905,11 +192621,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -199953,11 +192665,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -199999,11 +192707,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -200021,11 +192725,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -200041,8 +192741,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -200054,13 +192754,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -200094,11 +192794,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -200130,8 +192826,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -200222,11 +192918,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -200249,11 +192941,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -200307,7 +192995,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -200334,7 +193022,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -200350,11 +193038,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -200393,11 +193077,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -200444,8 +193124,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -200466,8 +193146,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -200516,7 +193196,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -200581,13 +193261,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -200615,7 +193295,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -200654,6 +193334,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -200661,11 +193346,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -200689,7 +193369,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -200804,11 +193484,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -200879,11 +193555,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -200910,11 +193582,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -200967,7 +193635,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -200983,7 +193655,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -201012,8 +193684,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -201093,8 +193765,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -201111,11 +193783,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -201159,11 +193827,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -201205,11 +193869,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -201227,11 +193887,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -201247,8 +193903,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -201260,13 +193916,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -201300,11 +193956,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -201336,8 +193988,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -201428,11 +194080,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -201455,11 +194103,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -201513,7 +194157,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -201540,7 +194184,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -201556,11 +194200,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -201599,11 +194239,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -201650,8 +194286,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -201672,8 +194308,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -201722,7 +194358,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -201787,13 +194423,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -201821,7 +194457,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -201860,6 +194496,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -201867,11 +194508,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -201895,7 +194531,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -202010,11 +194646,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -202085,11 +194717,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -202116,11 +194744,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -202173,7 +194797,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -202189,7 +194817,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -202218,8 +194846,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -202299,8 +194927,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -202317,11 +194945,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -202365,11 +194989,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -202411,11 +195031,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -202433,11 +195049,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -202453,8 +195065,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -202466,13 +195078,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -202506,11 +195118,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -202542,8 +195150,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -202634,11 +195242,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -202661,11 +195265,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -202719,7 +195319,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -202746,7 +195346,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -202762,11 +195362,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -202805,11 +195401,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -202856,8 +195448,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -202878,8 +195470,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -202928,7 +195520,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -202993,13 +195585,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -203027,7 +195619,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -203066,6 +195658,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -203073,11 +195670,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -203101,7 +195693,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -203216,11 +195808,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -203291,11 +195879,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -203322,11 +195906,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -203379,7 +195959,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -203395,7 +195979,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -203424,8 +196008,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -203505,8 +196089,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -203523,11 +196107,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -203571,11 +196151,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -203617,11 +196193,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -203639,11 +196211,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -203659,8 +196227,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -203672,13 +196240,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -203712,11 +196280,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -203748,8 +196312,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -203840,11 +196404,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -203867,11 +196427,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -203925,7 +196481,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -203952,7 +196508,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -203968,11 +196524,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -204011,11 +196563,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -204062,8 +196610,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -204084,8 +196632,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -204134,7 +196682,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -204199,13 +196747,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -204233,7 +196781,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -204272,6 +196820,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -204279,11 +196832,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -204307,7 +196855,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -204422,11 +196970,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -204497,11 +197041,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -204528,11 +197068,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -204585,7 +197121,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -204601,7 +197141,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -204630,8 +197170,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -204711,8 +197251,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -204729,11 +197269,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -204777,11 +197313,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -204823,11 +197355,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -204845,11 +197373,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -204865,8 +197389,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -204878,13 +197402,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -204918,11 +197442,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -204954,8 +197474,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -205046,11 +197566,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -205073,11 +197589,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -205131,7 +197643,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -205158,7 +197670,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -205174,11 +197686,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -205217,11 +197725,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -205268,8 +197772,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -205290,8 +197794,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -205340,7 +197844,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -205405,13 +197909,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -205439,7 +197943,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -205478,6 +197982,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -205485,11 +197994,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -205513,7 +198017,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -205628,11 +198132,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -205703,11 +198203,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -205734,11 +198230,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -205791,7 +198283,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -205807,7 +198303,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -205836,8 +198332,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -205917,8 +198413,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -205935,11 +198431,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -205983,11 +198475,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -206029,11 +198517,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -206051,11 +198535,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -206071,8 +198551,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -206084,13 +198564,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -206124,11 +198604,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -206160,8 +198636,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -206252,11 +198728,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -206279,11 +198751,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -206337,7 +198805,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -206364,7 +198832,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -206380,11 +198848,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -206423,11 +198887,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -206474,8 +198934,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -206496,8 +198956,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -206546,7 +199006,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -206611,13 +199071,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -206645,7 +199105,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -206684,6 +199144,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -206691,11 +199156,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -206719,7 +199179,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -206834,11 +199294,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -206909,11 +199365,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -206940,11 +199392,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -206997,7 +199445,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -207013,7 +199465,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -207042,8 +199494,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -207123,8 +199575,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -207141,11 +199593,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -207189,11 +199637,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -207235,11 +199679,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -207257,11 +199697,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -207277,8 +199713,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -207290,13 +199726,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -207330,11 +199766,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -207366,8 +199798,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -207458,11 +199890,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -207485,11 +199913,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -207543,7 +199967,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -207570,7 +199994,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -207586,11 +200010,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -207629,11 +200049,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -207680,8 +200096,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -207702,8 +200118,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -207752,7 +200168,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -207817,13 +200233,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -207851,7 +200267,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -207890,6 +200306,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -207897,11 +200318,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -207925,7 +200341,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -208040,11 +200456,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -208115,11 +200527,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -208146,11 +200554,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -208203,7 +200607,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -208219,7 +200627,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -208248,8 +200656,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -208329,8 +200737,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -208347,11 +200755,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -208395,11 +200799,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -208441,11 +200841,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -208463,11 +200859,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -208483,8 +200875,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -208496,13 +200888,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -208536,11 +200928,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -208572,8 +200960,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -208664,11 +201052,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -208691,11 +201075,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -208749,7 +201129,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -208776,7 +201156,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -208792,11 +201172,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -208835,11 +201211,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -208886,8 +201258,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -208908,8 +201280,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -208958,7 +201330,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -209023,13 +201395,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -209057,7 +201429,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -209096,6 +201468,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -209103,11 +201480,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -209131,7 +201503,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -209246,11 +201618,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -209321,11 +201689,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -209352,11 +201716,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -209409,7 +201769,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -209425,7 +201789,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -209454,8 +201818,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -209535,8 +201899,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -209553,11 +201917,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -209601,11 +201961,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -209647,11 +202003,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -209669,11 +202021,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -209689,8 +202037,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -209702,13 +202050,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -209742,11 +202090,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -209778,8 +202122,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -209870,11 +202214,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -209897,11 +202237,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -209955,7 +202291,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -209982,7 +202318,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -209998,11 +202334,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -210041,11 +202373,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -210092,8 +202420,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -210114,8 +202442,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -210164,7 +202492,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -210229,13 +202557,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -210263,7 +202591,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -210302,6 +202630,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -210309,11 +202642,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -210337,7 +202665,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -210452,11 +202780,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -210527,11 +202851,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -210558,11 +202878,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -210615,7 +202931,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -210631,7 +202951,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -210660,8 +202980,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -210741,8 +203061,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -210759,11 +203079,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -210807,11 +203123,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -210853,11 +203165,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -210875,11 +203183,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -210895,8 +203199,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -210908,13 +203212,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -210948,11 +203252,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -210984,8 +203284,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -211076,11 +203376,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -211103,11 +203399,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -211161,7 +203453,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -211188,7 +203480,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -211204,11 +203496,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -211247,11 +203535,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -211298,8 +203582,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -211320,8 +203604,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -211370,7 +203654,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -211435,13 +203719,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -211469,7 +203753,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -211508,6 +203792,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -211515,11 +203804,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -211543,7 +203827,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -211658,11 +203942,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -211733,11 +204013,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -211764,11 +204040,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -211821,7 +204093,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -211837,7 +204113,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -211866,8 +204142,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -211947,8 +204223,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -211965,11 +204241,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -212013,11 +204285,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -212059,11 +204327,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -212081,11 +204345,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -212101,8 +204361,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -212114,13 +204374,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -212154,11 +204414,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -212190,8 +204446,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -212282,11 +204538,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -212309,11 +204561,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -212367,7 +204615,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -212394,7 +204642,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -212410,11 +204658,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -212453,11 +204697,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -212504,8 +204744,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -212526,8 +204766,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -212576,7 +204816,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -212641,13 +204881,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -212675,7 +204915,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -212714,6 +204954,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -212721,11 +204966,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -212749,7 +204989,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -212864,11 +205104,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -212939,11 +205175,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -212970,11 +205202,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -213027,7 +205255,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -213043,7 +205275,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -213072,8 +205304,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -213153,8 +205385,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -213171,11 +205403,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -213219,11 +205447,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -213265,11 +205489,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -213287,11 +205507,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -213307,8 +205523,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -213320,13 +205536,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -213360,11 +205576,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -213396,8 +205608,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -213488,11 +205700,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -213515,11 +205723,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -213573,7 +205777,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -213600,7 +205804,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -213616,11 +205820,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -213659,11 +205859,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -213710,8 +205906,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -213732,8 +205928,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -213782,7 +205978,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -213847,13 +206043,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -213881,7 +206077,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -213920,6 +206116,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -213927,11 +206128,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -213955,7 +206151,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -214070,11 +206266,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -214145,11 +206337,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -214176,11 +206364,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -214233,7 +206417,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -214249,7 +206437,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -214278,8 +206466,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -214359,8 +206547,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -214377,11 +206565,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -214425,11 +206609,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -214471,11 +206651,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -214493,11 +206669,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -214513,8 +206685,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -214526,13 +206698,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -214566,11 +206738,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -214602,8 +206770,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -214694,11 +206862,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -214721,11 +206885,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -214779,7 +206939,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -214806,7 +206966,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -214822,11 +206982,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -214865,11 +207021,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -214916,8 +207068,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -214938,8 +207090,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -214988,7 +207140,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -215053,13 +207205,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -215087,7 +207239,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -215126,6 +207278,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -215133,11 +207290,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -215161,7 +207313,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -215276,11 +207428,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -215351,11 +207499,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -215382,11 +207526,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -215439,7 +207579,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -215455,7 +207599,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -215484,8 +207628,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -215565,8 +207709,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -215583,11 +207727,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -215631,11 +207771,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -215677,11 +207813,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -215699,11 +207831,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -215719,8 +207847,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -215732,13 +207860,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -215772,11 +207900,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -215808,8 +207932,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -215900,11 +208024,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -215927,11 +208047,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -215985,7 +208101,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -216012,7 +208128,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -216028,11 +208144,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -216071,11 +208183,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -216122,8 +208230,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -216144,8 +208252,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -216194,7 +208302,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -216259,13 +208367,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -216293,7 +208401,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -216332,6 +208440,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -216339,11 +208452,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -216367,7 +208475,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -216482,11 +208590,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -216557,11 +208661,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -216588,11 +208688,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -216645,7 +208741,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -216661,7 +208761,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -216690,8 +208790,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -216771,8 +208871,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -216789,11 +208889,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -216837,11 +208933,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -216883,11 +208975,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -216905,11 +208993,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -216925,8 +209009,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -216938,13 +209022,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -216978,11 +209062,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -217014,8 +209094,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -217106,11 +209186,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -217133,11 +209209,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -217191,7 +209263,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -217218,7 +209290,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -217234,11 +209306,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -217277,11 +209345,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -217328,8 +209392,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -217350,8 +209414,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -217400,7 +209464,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -217465,13 +209529,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -217499,7 +209563,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -217538,6 +209602,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -217545,11 +209614,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -217573,7 +209637,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -217688,11 +209752,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -217763,11 +209823,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -217794,11 +209850,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -217851,7 +209903,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -217867,7 +209923,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -217896,8 +209952,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -217977,8 +210033,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -217995,11 +210051,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -218043,11 +210095,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -218089,11 +210137,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -218111,11 +210155,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -218131,8 +210171,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -218144,13 +210184,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -218184,11 +210224,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -218220,8 +210256,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -218312,11 +210348,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -218339,11 +210371,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -218397,7 +210425,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -218424,7 +210452,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -218440,11 +210468,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -218483,11 +210507,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -218534,8 +210554,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -218556,8 +210576,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -218606,7 +210626,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -218671,13 +210691,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -218705,7 +210725,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -218744,6 +210764,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -218751,11 +210776,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -218779,7 +210799,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -218894,11 +210914,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -218969,11 +210985,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -219000,11 +211012,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -219057,7 +211065,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -219073,7 +211085,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -219102,8 +211114,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -219183,8 +211195,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -219201,11 +211213,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -219249,11 +211257,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -219295,11 +211299,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -219317,11 +211317,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -219337,8 +211333,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -219350,13 +211346,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -219390,11 +211386,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -219426,8 +211418,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -219518,11 +211510,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -219545,11 +211533,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -219603,7 +211587,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -219630,7 +211614,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -219646,11 +211630,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -219689,11 +211669,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -219740,8 +211716,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -219762,8 +211738,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -219812,7 +211788,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -219877,13 +211853,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -219911,7 +211887,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -219950,6 +211926,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -219957,11 +211938,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -219985,7 +211961,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -220100,11 +212076,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -220175,11 +212147,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -220206,11 +212174,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -220263,7 +212227,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -220279,7 +212247,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -220308,8 +212276,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -220389,8 +212357,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -220407,11 +212375,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -220455,11 +212419,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -220501,11 +212461,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -220523,11 +212479,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -220543,8 +212495,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -220556,13 +212508,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -220596,11 +212548,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -220632,8 +212580,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -220724,11 +212672,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -220751,11 +212695,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -220809,7 +212749,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -220836,7 +212776,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -220852,11 +212792,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -220895,11 +212831,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -220946,8 +212878,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -220968,8 +212900,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -221018,7 +212950,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -221083,13 +213015,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -221117,7 +213049,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -221156,6 +213088,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -221163,11 +213100,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -221191,7 +213123,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -221306,11 +213238,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -221381,11 +213309,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -221412,11 +213336,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -221469,7 +213389,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -221485,7 +213409,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -221514,8 +213438,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -221595,8 +213519,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -221613,11 +213537,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -221661,11 +213581,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -221707,11 +213623,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -221729,11 +213641,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -221749,8 +213657,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -221762,13 +213670,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -221802,11 +213710,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -221838,8 +213742,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -221930,11 +213834,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -221957,11 +213857,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -222015,7 +213911,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -222042,7 +213938,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -222058,11 +213954,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -222101,11 +213993,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -222152,8 +214040,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -222174,8 +214062,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -222224,7 +214112,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -222289,13 +214177,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -222323,7 +214211,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -222362,6 +214250,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -222369,11 +214262,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -222397,7 +214285,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -222512,11 +214400,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -222587,11 +214471,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -222618,11 +214498,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -222675,7 +214551,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -222691,7 +214571,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -222720,8 +214600,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -222801,8 +214681,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -222819,11 +214699,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -222867,11 +214743,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -222913,11 +214785,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -222935,11 +214803,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -222955,8 +214819,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -222968,13 +214832,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -223008,11 +214872,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -223044,8 +214904,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -223136,11 +214996,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -223163,11 +215019,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -223221,7 +215073,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -223248,7 +215100,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -223264,11 +215116,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -223307,11 +215155,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -223358,8 +215202,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -223380,8 +215224,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -223430,7 +215274,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -223495,13 +215339,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -223529,7 +215373,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -223568,6 +215412,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -223575,11 +215424,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -223603,7 +215447,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -223718,11 +215562,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -223793,11 +215633,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -223824,11 +215660,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -223881,7 +215713,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -223897,7 +215733,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -223926,8 +215762,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -224007,8 +215843,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -224025,11 +215861,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -224073,11 +215905,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -224119,11 +215947,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -224141,11 +215965,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -224161,8 +215981,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -224174,13 +215994,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -224214,11 +216034,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -224250,8 +216066,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -224342,11 +216158,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -224369,11 +216181,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -224427,7 +216235,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -224454,7 +216262,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -224470,11 +216278,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -224513,11 +216317,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -224564,8 +216364,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -224586,8 +216386,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -224636,7 +216436,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -224701,13 +216501,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -224735,7 +216535,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -224774,6 +216574,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -224781,11 +216586,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -224809,7 +216609,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -224924,11 +216724,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -224999,11 +216795,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -225030,11 +216822,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -225087,7 +216875,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -225103,7 +216895,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -225132,8 +216924,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -225213,8 +217005,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -225231,11 +217023,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -225279,11 +217067,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -225325,11 +217109,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -225347,11 +217127,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -225367,8 +217143,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -225380,13 +217156,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -225420,11 +217196,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -225456,8 +217228,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -225548,11 +217320,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -225575,11 +217343,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -225633,7 +217397,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -225660,7 +217424,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -225676,11 +217440,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -225719,11 +217479,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -225770,8 +217526,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -225792,8 +217548,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -225842,7 +217598,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -225907,13 +217663,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -225941,7 +217697,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -225980,6 +217736,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -225987,11 +217748,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -226015,7 +217771,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -226130,11 +217886,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -226205,11 +217957,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -226236,11 +217984,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -226293,7 +218037,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -226309,7 +218057,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -226338,8 +218086,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -226419,8 +218167,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -226437,11 +218185,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -226485,11 +218229,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -226531,11 +218271,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -226553,11 +218289,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -226573,8 +218305,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -226586,13 +218318,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -226626,11 +218358,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -226662,8 +218390,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -226754,11 +218482,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -226781,11 +218505,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -226839,7 +218559,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -226866,7 +218586,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -226882,11 +218602,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -226925,11 +218641,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -226976,8 +218688,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -226998,8 +218710,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -227048,7 +218760,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -227113,13 +218825,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -227147,7 +218859,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -227186,6 +218898,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -227193,11 +218910,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -227221,7 +218933,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -227336,11 +219048,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -227411,11 +219119,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -227442,11 +219146,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -227499,7 +219199,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -227515,7 +219219,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -227544,8 +219248,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -227625,8 +219329,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -227643,11 +219347,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -227691,11 +219391,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -227737,11 +219433,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -227759,11 +219451,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -227779,8 +219467,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -227792,13 +219480,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -227832,11 +219520,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -227868,8 +219552,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -227960,11 +219644,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -227987,11 +219667,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -228045,7 +219721,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -228072,7 +219748,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -228088,11 +219764,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -228131,11 +219803,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -228182,8 +219850,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -228204,8 +219872,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -228254,7 +219922,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -228319,13 +219987,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -228353,7 +220021,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -228392,6 +220060,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -228399,11 +220072,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -228427,7 +220095,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -228542,11 +220210,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -228617,11 +220281,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -228648,11 +220308,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -228705,7 +220361,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -228721,7 +220381,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -228750,8 +220410,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -228831,8 +220491,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -228849,11 +220509,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -228897,11 +220553,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -228943,11 +220595,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -228965,11 +220613,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -228985,8 +220629,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -228998,13 +220642,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -229038,11 +220682,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -229074,8 +220714,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -229166,11 +220806,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -229193,11 +220829,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -229251,7 +220883,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -229278,7 +220910,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -229294,11 +220926,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -229337,11 +220965,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -229388,8 +221012,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -229410,8 +221034,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -229460,7 +221084,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -229525,13 +221149,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -229559,7 +221183,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -229598,6 +221222,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -229605,11 +221234,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -229633,7 +221257,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -229748,11 +221372,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -229823,11 +221443,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -229854,11 +221470,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -229911,7 +221523,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -229927,7 +221543,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -229956,8 +221572,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -230037,8 +221653,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -230055,11 +221671,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -230103,11 +221715,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -230149,11 +221757,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -230171,11 +221775,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -230191,8 +221791,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -230204,13 +221804,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -230244,11 +221844,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -230280,8 +221876,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -230372,11 +221968,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -230399,11 +221991,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -230457,7 +222045,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -230484,7 +222072,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -230500,11 +222088,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -230543,11 +222127,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -230594,8 +222174,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -230616,8 +222196,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -230666,7 +222246,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -230731,13 +222311,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -230765,7 +222345,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -230804,6 +222384,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -230811,11 +222396,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -230839,7 +222419,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -230954,11 +222534,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -231029,11 +222605,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -231060,11 +222632,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -231117,7 +222685,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -231133,7 +222705,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -231162,8 +222734,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -231243,8 +222815,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -231261,11 +222833,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -231309,11 +222877,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -231355,11 +222919,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -231377,11 +222937,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -231397,8 +222953,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -231410,13 +222966,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -231450,11 +223006,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -231486,8 +223038,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -231578,11 +223130,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -231605,11 +223153,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -231663,7 +223207,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -231690,7 +223234,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -231706,11 +223250,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -231749,11 +223289,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -231800,8 +223336,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -231822,8 +223358,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -231872,7 +223408,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -231937,13 +223473,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -231971,7 +223507,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -232010,6 +223546,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -232017,11 +223558,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -232045,7 +223581,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -232160,11 +223696,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -232235,11 +223767,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -232266,11 +223794,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -232323,7 +223847,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -232339,7 +223867,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -232368,8 +223896,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -232449,8 +223977,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -232467,11 +223995,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -232515,11 +224039,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -232561,11 +224081,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -232583,11 +224099,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -232603,8 +224115,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -232616,13 +224128,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -232656,11 +224168,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -232692,8 +224200,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -232784,11 +224292,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -232811,11 +224315,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -232869,7 +224369,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -232896,7 +224396,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -232912,11 +224412,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -232955,11 +224451,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -233006,8 +224498,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -233028,8 +224520,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -233078,7 +224570,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -233143,13 +224635,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -233177,7 +224669,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -233216,6 +224708,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -233223,11 +224720,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -233251,7 +224743,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -233366,11 +224858,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -233441,11 +224929,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -233472,11 +224956,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -233529,7 +225009,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -233545,7 +225029,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -233574,8 +225058,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -233655,8 +225139,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -233673,11 +225157,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -233721,11 +225201,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -233767,11 +225243,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -233789,11 +225261,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -233809,8 +225277,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -233822,13 +225290,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -233862,11 +225330,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -233898,8 +225362,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -233990,11 +225454,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -234017,11 +225477,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -234075,7 +225531,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -234102,7 +225558,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -234118,11 +225574,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -234161,11 +225613,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -234212,8 +225660,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -234234,8 +225682,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -234284,7 +225732,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -234349,13 +225797,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -234383,7 +225831,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -234422,6 +225870,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -234429,11 +225882,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -234457,7 +225905,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -234572,11 +226020,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -234647,11 +226091,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -234678,11 +226118,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -234735,7 +226171,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -234751,7 +226191,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -234780,8 +226220,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -234861,8 +226301,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -234879,11 +226319,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -234927,11 +226363,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -234973,11 +226405,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -234995,11 +226423,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -235015,8 +226439,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -235028,13 +226452,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -235068,11 +226492,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -235104,8 +226524,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -235196,11 +226616,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -235223,11 +226639,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -235281,7 +226693,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -235308,7 +226720,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -235324,11 +226736,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -235367,11 +226775,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -235418,8 +226822,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -235440,8 +226844,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -235490,7 +226894,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -235555,13 +226959,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -235589,7 +226993,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -235628,6 +227032,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -235635,11 +227044,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -235663,7 +227067,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -235778,11 +227182,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -235853,11 +227253,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -235884,11 +227280,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -235941,7 +227333,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -235957,7 +227353,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -235986,8 +227382,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -236067,8 +227463,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -236085,11 +227481,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -236133,11 +227525,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -236179,11 +227567,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -236201,11 +227585,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -236221,8 +227601,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -236234,13 +227614,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -236274,11 +227654,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -236310,8 +227686,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -236402,11 +227778,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -236429,11 +227801,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -236487,7 +227855,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -236514,7 +227882,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -236530,11 +227898,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -236573,11 +227937,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -236624,8 +227984,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -236646,8 +228006,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -236696,7 +228056,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -236761,13 +228121,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -236795,7 +228155,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -236834,6 +228194,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -236841,11 +228206,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -236869,7 +228229,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -236984,11 +228344,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -237059,11 +228415,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -237090,11 +228442,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -237147,7 +228495,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -237163,7 +228515,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -237192,8 +228544,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -237273,8 +228625,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -237291,11 +228643,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -237339,11 +228687,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -237385,11 +228729,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -237407,11 +228747,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -237427,8 +228763,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -237440,13 +228776,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -237480,11 +228816,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -237516,8 +228848,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -237608,11 +228940,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -237635,11 +228963,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -237693,7 +229017,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -237720,7 +229044,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -237736,11 +229060,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -237779,11 +229099,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -237830,8 +229146,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -237852,8 +229168,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -237902,7 +229218,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -237967,13 +229283,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -238001,7 +229317,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -238040,6 +229356,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -238047,11 +229368,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -238075,7 +229391,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -238190,11 +229506,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -238265,11 +229577,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -238296,11 +229604,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -238353,7 +229657,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -238369,7 +229677,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -238398,8 +229706,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -238479,8 +229787,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -238497,11 +229805,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -238545,11 +229849,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -238591,11 +229891,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -238613,11 +229909,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -238633,8 +229925,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -238646,13 +229938,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -238686,11 +229978,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -238722,8 +230010,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -238814,11 +230102,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -238841,11 +230125,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -238899,7 +230179,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -238926,7 +230206,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -238942,11 +230222,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -238985,11 +230261,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -239036,8 +230308,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -239058,8 +230330,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -239108,7 +230380,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -239173,13 +230445,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -239207,7 +230479,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -239246,6 +230518,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -239253,11 +230530,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -239281,7 +230553,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -239396,11 +230668,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -239471,11 +230739,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -239502,11 +230766,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -239559,7 +230819,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -239575,7 +230839,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -239604,8 +230868,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -239685,8 +230949,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -239703,11 +230967,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -239751,11 +231011,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -239797,11 +231053,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -239819,11 +231071,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -239839,8 +231087,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -239852,13 +231100,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -239892,11 +231140,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -239928,8 +231172,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -240020,11 +231264,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -240047,11 +231287,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -240105,7 +231341,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -240132,7 +231368,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -240148,11 +231384,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -240191,11 +231423,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -240242,8 +231470,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -240264,8 +231492,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -240314,7 +231542,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -240379,13 +231607,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -240413,7 +231641,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -240452,6 +231680,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -240459,11 +231692,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -240487,7 +231715,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -240602,11 +231830,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -240677,11 +231901,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -240708,11 +231928,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -240765,7 +231981,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -240781,7 +232001,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -240810,8 +232030,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -240891,8 +232111,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -240909,11 +232129,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -240957,11 +232173,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -241003,11 +232215,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -241025,11 +232233,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -241045,8 +232249,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -241058,13 +232262,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -241098,11 +232302,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -241134,8 +232334,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -241226,11 +232426,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -241253,11 +232449,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -241311,7 +232503,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -241338,7 +232530,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -241354,11 +232546,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -241397,11 +232585,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -241448,8 +232632,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -241470,8 +232654,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -241520,7 +232704,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -241585,13 +232769,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -241619,7 +232803,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -241658,6 +232842,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -241665,11 +232854,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -241693,7 +232877,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -241808,11 +232992,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -241883,11 +233063,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -241914,11 +233090,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -241971,7 +233143,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -241987,7 +233163,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -242016,8 +233192,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -242097,8 +233273,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -242115,11 +233291,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -242163,11 +233335,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -242209,11 +233377,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -242231,11 +233395,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -242251,8 +233411,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -242264,13 +233424,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -242304,11 +233464,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -242340,8 +233496,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -242432,11 +233588,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -242459,11 +233611,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -242517,7 +233665,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -242544,7 +233692,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -242560,11 +233708,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -242603,11 +233747,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -242654,8 +233794,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -242676,8 +233816,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -242726,7 +233866,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -242791,13 +233931,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -242825,7 +233965,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -242864,6 +234004,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -242871,11 +234016,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -242899,7 +234039,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -243014,11 +234154,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -243089,11 +234225,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -243120,11 +234252,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -243177,7 +234305,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -243193,7 +234325,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -243222,8 +234354,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -243303,8 +234435,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -243321,11 +234453,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -243369,11 +234497,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -243415,11 +234539,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -243437,11 +234557,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -243457,8 +234573,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -243470,13 +234586,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -243510,11 +234626,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -243546,8 +234658,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -243638,11 +234750,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -243665,11 +234773,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -243723,7 +234827,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -243750,7 +234854,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -243766,11 +234870,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -243809,11 +234909,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -243860,8 +234956,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -243882,8 +234978,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -243932,7 +235028,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -243997,13 +235093,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -244031,7 +235127,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -244070,6 +235166,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -244077,11 +235178,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -244105,7 +235201,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -244220,11 +235316,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -244295,11 +235387,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -244326,11 +235414,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -244383,7 +235467,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -244399,7 +235487,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -244428,8 +235516,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -244509,8 +235597,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -244527,11 +235615,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -244575,11 +235659,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -244621,11 +235701,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -244643,11 +235719,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -244663,8 +235735,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -244676,13 +235748,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -244716,11 +235788,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -244752,8 +235820,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -244844,11 +235912,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -244871,11 +235935,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -244929,7 +235989,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -244956,7 +236016,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -244972,11 +236032,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -245015,11 +236071,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -245066,8 +236118,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -245088,8 +236140,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -245138,7 +236190,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -245203,13 +236255,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -245237,7 +236289,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -245276,6 +236328,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -245283,11 +236340,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -245311,7 +236363,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -245426,11 +236478,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -245501,11 +236549,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -245532,11 +236576,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -245589,7 +236629,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -245605,7 +236649,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -245634,8 +236678,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -245715,8 +236759,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -245733,11 +236777,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -245781,11 +236821,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -245827,11 +236863,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -245849,11 +236881,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -245869,8 +236897,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -245882,13 +236910,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -245922,11 +236950,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -245958,8 +236982,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -246050,11 +237074,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -246077,11 +237097,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -246135,7 +237151,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -246162,7 +237178,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -246178,11 +237194,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -246221,11 +237233,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -246272,8 +237280,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -246294,8 +237302,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -246344,7 +237352,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -246409,13 +237417,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -246443,7 +237451,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -246482,6 +237490,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -246489,11 +237502,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -246517,7 +237525,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -246632,11 +237640,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -246707,11 +237711,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -246738,11 +237738,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -246795,7 +237791,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -246811,7 +237811,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -246840,8 +237840,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -246921,8 +237921,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -246939,11 +237939,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -246987,11 +237983,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -247033,11 +238025,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -247055,11 +238043,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -247075,8 +238059,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -247088,13 +238072,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -247128,11 +238112,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -247164,8 +238144,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -247256,11 +238236,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -247283,11 +238259,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -247341,7 +238313,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -247368,7 +238340,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -247384,11 +238356,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -247427,11 +238395,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -247478,8 +238442,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -247500,8 +238464,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -247550,7 +238514,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -247615,13 +238579,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -247649,7 +238613,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -247688,6 +238652,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -247695,11 +238664,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -247723,7 +238687,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -247838,11 +238802,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -247913,11 +238873,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -247944,11 +238900,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -248001,7 +238953,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -248017,7 +238973,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -248046,8 +239002,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -248127,8 +239083,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -248145,11 +239101,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -248193,11 +239145,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -248239,11 +239187,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -248261,11 +239205,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -248281,8 +239221,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -248294,13 +239234,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -248334,11 +239274,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -248370,8 +239306,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -248462,11 +239398,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -248489,11 +239421,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -248547,7 +239475,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -248574,7 +239502,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -248590,11 +239518,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -248633,11 +239557,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -248684,8 +239604,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -248706,8 +239626,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -248756,7 +239676,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -248821,13 +239741,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -248855,7 +239775,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -248894,6 +239814,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -248901,11 +239826,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -248929,7 +239849,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -249044,11 +239964,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -249119,11 +240035,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -249150,11 +240062,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -249207,7 +240115,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -249223,7 +240135,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -249252,8 +240164,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -249333,8 +240245,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -249351,11 +240263,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -249399,11 +240307,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -249445,11 +240349,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -249467,11 +240367,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -249487,8 +240383,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -249500,13 +240396,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -249540,11 +240436,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -249576,8 +240468,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -249668,11 +240560,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -249695,11 +240583,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -249753,7 +240637,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -249780,7 +240664,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -249796,11 +240680,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -249839,11 +240719,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -249890,8 +240766,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -249912,8 +240788,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -249962,7 +240838,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -250027,13 +240903,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -250061,7 +240937,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -250100,6 +240976,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -250107,11 +240988,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -250135,7 +241011,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -250250,11 +241126,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -250325,11 +241197,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -250356,11 +241224,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -250413,7 +241277,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -250429,7 +241297,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -250458,8 +241326,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -250539,8 +241407,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -250557,11 +241425,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -250605,11 +241469,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -250651,11 +241511,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -250673,11 +241529,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -250693,8 +241545,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -250706,13 +241558,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -250746,11 +241598,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -250782,8 +241630,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -250874,11 +241722,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -250901,11 +241745,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -250959,7 +241799,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -250986,7 +241826,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -251002,11 +241842,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -251045,11 +241881,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -251096,8 +241928,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -251118,8 +241950,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -251168,7 +242000,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -251233,13 +242065,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -251267,7 +242099,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -251306,6 +242138,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -251313,11 +242150,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -251341,7 +242173,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -251456,11 +242288,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -251531,11 +242359,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -251562,11 +242386,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -251619,7 +242439,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -251635,7 +242459,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -251664,8 +242488,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -251745,8 +242569,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -251763,11 +242587,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -251811,11 +242631,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -251857,11 +242673,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -251879,11 +242691,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -251899,8 +242707,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -251912,13 +242720,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -251952,11 +242760,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -251988,8 +242792,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -252080,11 +242884,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -252107,11 +242907,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -252165,7 +242961,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -252192,7 +242988,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -252208,11 +243004,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -252251,11 +243043,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -252302,8 +243090,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -252324,8 +243112,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -252374,7 +243162,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -252439,13 +243227,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -252473,7 +243261,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -252512,6 +243300,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -252519,11 +243312,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -252547,7 +243335,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -252662,11 +243450,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -252737,11 +243521,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -252768,11 +243548,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -252825,7 +243601,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -252841,7 +243621,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -252870,8 +243650,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -252951,8 +243731,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -252969,11 +243749,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -253017,11 +243793,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -253063,11 +243835,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -253085,11 +243853,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -253105,8 +243869,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -253118,13 +243882,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -253158,11 +243922,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -253194,8 +243954,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -253286,11 +244046,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -253313,11 +244069,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -253371,7 +244123,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -253398,7 +244150,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -253414,11 +244166,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -253457,11 +244205,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -253508,8 +244252,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -253530,8 +244274,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -253580,7 +244324,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -253645,13 +244389,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -253679,7 +244423,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -253718,6 +244462,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -253725,11 +244474,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -253753,7 +244497,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -253868,11 +244612,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -253943,11 +244683,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -253974,11 +244710,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -254031,7 +244763,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -254047,7 +244783,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -254076,8 +244812,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -254157,8 +244893,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -254175,11 +244911,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -254223,11 +244955,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -254269,11 +244997,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -254291,11 +245015,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -254311,8 +245031,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -254324,13 +245044,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -254364,11 +245084,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -254400,8 +245116,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -254492,11 +245208,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -254519,11 +245231,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -254577,7 +245285,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -254604,7 +245312,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -254620,11 +245328,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -254663,11 +245367,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -254714,8 +245414,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -254736,8 +245436,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -254786,7 +245486,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -254851,13 +245551,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -254885,7 +245585,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -254924,6 +245624,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -254931,11 +245636,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -254959,7 +245659,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -255074,11 +245774,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -255149,11 +245845,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -255180,11 +245872,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -255237,7 +245925,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -255253,7 +245945,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -255282,8 +245974,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -255363,8 +246055,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -255381,11 +246073,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -255429,11 +246117,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -255475,11 +246159,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -255497,11 +246177,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -255517,8 +246193,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -255530,13 +246206,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -255570,11 +246246,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -255606,8 +246278,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -255698,11 +246370,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -255725,11 +246393,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -255783,7 +246447,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -255810,7 +246474,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -255826,11 +246490,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -255869,11 +246529,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -255920,8 +246576,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -255942,8 +246598,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -255992,7 +246648,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -256057,13 +246713,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -256091,7 +246747,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -256130,6 +246786,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -256137,11 +246798,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -256165,7 +246821,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -256280,11 +246936,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -256355,11 +247007,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -256386,11 +247034,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -256443,7 +247087,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -256459,7 +247107,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -256488,8 +247136,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -256569,8 +247217,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -256587,11 +247235,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -256635,11 +247279,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -256681,11 +247321,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -256703,11 +247339,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -256723,8 +247355,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -256736,13 +247368,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -256776,11 +247408,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -256812,8 +247440,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -256904,11 +247532,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -256931,11 +247555,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -256989,7 +247609,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -257016,7 +247636,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -257032,11 +247652,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -257075,11 +247691,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -257126,8 +247738,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -257148,8 +247760,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -257198,7 +247810,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -257263,13 +247875,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -257297,7 +247909,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -257336,6 +247948,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -257343,11 +247960,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -257371,7 +247983,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -257486,11 +248098,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -257561,11 +248169,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -257592,11 +248196,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -257649,7 +248249,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -257665,7 +248269,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -257694,8 +248298,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -257775,8 +248379,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -257793,11 +248397,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -257841,11 +248441,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -257887,11 +248483,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -257909,11 +248501,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -257929,8 +248517,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -257942,13 +248530,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -257982,11 +248570,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -258018,8 +248602,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -258110,11 +248694,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -258137,11 +248717,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -258195,7 +248771,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -258222,7 +248798,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -258238,11 +248814,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -258281,11 +248853,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -258332,8 +248900,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -258354,8 +248922,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -258404,7 +248972,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -258469,13 +249037,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -258503,7 +249071,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -258542,6 +249110,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -258549,11 +249122,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -258577,7 +249145,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -258692,11 +249260,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -258767,11 +249331,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -258798,11 +249358,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -258855,7 +249411,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -258871,7 +249431,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -258900,8 +249460,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -258981,8 +249541,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -258999,11 +249559,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -259047,11 +249603,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -259093,11 +249645,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -259115,11 +249663,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -259135,8 +249679,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -259148,13 +249692,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -259188,11 +249732,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -259224,8 +249764,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -259316,11 +249856,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -259343,11 +249879,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -259401,7 +249933,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -259428,7 +249960,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -259444,11 +249976,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -259487,11 +250015,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -259538,8 +250062,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -259560,8 +250084,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -259610,7 +250134,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -259675,13 +250199,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -259709,7 +250233,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -259748,6 +250272,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -259755,11 +250284,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -259783,7 +250307,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -259898,11 +250422,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -259973,11 +250493,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -260004,11 +250520,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -260061,7 +250573,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -260077,7 +250593,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -260106,8 +250622,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -260187,8 +250703,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -260205,11 +250721,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -260253,11 +250765,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -260299,11 +250807,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -260321,11 +250825,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -260341,8 +250841,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -260354,13 +250854,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -260394,11 +250894,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -260430,8 +250926,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -260522,11 +251018,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -260549,11 +251041,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -260607,7 +251095,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -260634,7 +251122,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -260650,11 +251138,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -260693,11 +251177,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -260744,8 +251224,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -260766,8 +251246,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -260816,7 +251296,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -260881,13 +251361,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -260915,7 +251395,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -260954,6 +251434,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -260961,11 +251446,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -260989,7 +251469,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -261104,11 +251584,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -261179,11 +251655,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -261210,11 +251682,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -261267,7 +251735,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -261283,7 +251755,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -261312,8 +251784,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -261393,8 +251865,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -261411,11 +251883,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -261459,11 +251927,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -261505,11 +251969,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -261527,11 +251987,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -261547,8 +252003,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -261560,13 +252016,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -261600,11 +252056,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -261636,8 +252088,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -261728,11 +252180,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -261755,11 +252203,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -261813,7 +252257,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -261840,7 +252284,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -261856,11 +252300,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -261899,11 +252339,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -261950,8 +252386,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -261972,8 +252408,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -262022,7 +252458,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -262087,13 +252523,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -262121,7 +252557,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -262160,6 +252596,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -262167,11 +252608,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -262195,7 +252631,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -262310,11 +252746,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -262385,11 +252817,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -262416,11 +252844,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -262473,7 +252897,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -262489,7 +252917,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -262518,8 +252946,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -262599,8 +253027,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -262617,11 +253045,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -262665,11 +253089,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -262711,11 +253131,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -262733,11 +253149,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -262753,8 +253165,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -262766,13 +253178,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -262806,11 +253218,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -262842,8 +253250,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -262934,11 +253342,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -262961,11 +253365,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -263019,7 +253419,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -263046,7 +253446,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -263062,11 +253462,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -263105,11 +253501,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -263156,8 +253548,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -263178,8 +253570,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -263228,7 +253620,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -263293,13 +253685,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -263327,7 +253719,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -263366,6 +253758,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -263373,11 +253770,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -263401,7 +253793,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -263516,11 +253908,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -263591,11 +253979,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -263622,11 +254006,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -263679,7 +254059,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -263695,7 +254079,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -263724,8 +254108,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -263805,8 +254189,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -263823,11 +254207,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -263871,11 +254251,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -263917,11 +254293,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -263939,11 +254311,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -263959,8 +254327,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -263972,13 +254340,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -264012,11 +254380,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -264048,8 +254412,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -264140,11 +254504,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -264167,11 +254527,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -264225,7 +254581,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -264252,7 +254608,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -264268,11 +254624,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -264311,11 +254663,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -264362,8 +254710,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -264384,8 +254732,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -264434,7 +254782,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -264499,13 +254847,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -264533,7 +254881,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -264572,6 +254920,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -264579,11 +254932,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -264607,7 +254955,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -264722,11 +255070,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -264797,11 +255141,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -264828,11 +255168,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -264885,7 +255221,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -264901,7 +255241,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -264930,8 +255270,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -265011,8 +255351,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -265029,11 +255369,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -265077,11 +255413,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -265123,11 +255455,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -265145,11 +255473,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -265165,8 +255489,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -265178,13 +255502,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -265218,11 +255542,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -265254,8 +255574,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -265346,11 +255666,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -265373,11 +255689,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -265431,7 +255743,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -265458,7 +255770,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -265474,11 +255786,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -265517,11 +255825,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -265568,8 +255872,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -265590,8 +255894,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -265640,7 +255944,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -265705,13 +256009,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -265739,7 +256043,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -265778,6 +256082,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -265785,11 +256094,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -265813,7 +256117,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -265928,11 +256232,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -266003,11 +256303,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -266034,11 +256330,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -266091,7 +256383,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -266107,7 +256403,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -266136,8 +256432,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -266217,8 +256513,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -266235,11 +256531,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -266283,11 +256575,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -266329,11 +256617,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -266351,11 +256635,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -266371,8 +256651,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -266384,13 +256664,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -266424,11 +256704,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -266460,8 +256736,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -266552,11 +256828,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -266579,11 +256851,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -266637,7 +256905,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -266664,7 +256932,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -266680,11 +256948,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -266723,11 +256987,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -266774,8 +257034,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -266796,8 +257056,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -266846,7 +257106,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -266911,13 +257171,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -266945,7 +257205,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -266984,6 +257244,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -266991,11 +257256,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -267019,7 +257279,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -267134,11 +257394,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -267209,11 +257465,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -267240,11 +257492,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -267297,7 +257545,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -267313,7 +257565,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -267342,8 +257594,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -267423,8 +257675,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -267441,11 +257693,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -267489,11 +257737,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -267535,11 +257779,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -267557,11 +257797,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -267577,8 +257813,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -267590,13 +257826,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -267630,11 +257866,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -267666,8 +257898,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -267758,11 +257990,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -267785,11 +258013,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -267843,7 +258067,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -267870,7 +258094,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -267886,11 +258110,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -267929,11 +258149,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -267980,8 +258196,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -268002,8 +258218,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -268052,7 +258268,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -268117,13 +258333,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -268151,7 +258367,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -268190,6 +258406,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -268197,11 +258418,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -268225,7 +258441,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -268340,11 +258556,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -268415,11 +258627,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -268446,11 +258654,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -268503,7 +258707,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -268519,7 +258727,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -268548,8 +258756,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -268629,8 +258837,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -268647,11 +258855,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -268695,11 +258899,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -268741,11 +258941,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -268763,11 +258959,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -268783,8 +258975,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -268796,13 +258988,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -268836,11 +259028,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -268872,8 +259060,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -268964,11 +259152,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -268991,11 +259175,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -269049,7 +259229,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -269076,7 +259256,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -269092,11 +259272,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -269135,11 +259311,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -269186,8 +259358,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -269208,8 +259380,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -269258,7 +259430,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -269323,13 +259495,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -269357,7 +259529,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -269396,6 +259568,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -269403,11 +259580,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -269431,7 +259603,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -269546,11 +259718,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -269621,11 +259789,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -269652,11 +259816,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -269709,7 +259869,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -269725,7 +259889,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -269754,8 +259918,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -269835,8 +259999,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -269853,11 +260017,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -269901,11 +260061,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -269947,11 +260103,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -269969,11 +260121,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -269989,8 +260137,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -270002,13 +260150,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -270042,11 +260190,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -270078,8 +260222,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -270170,11 +260314,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -270197,11 +260337,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -270255,7 +260391,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -270282,7 +260418,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -270298,11 +260434,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -270341,11 +260473,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -270392,8 +260520,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -270414,8 +260542,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -270464,7 +260592,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -270529,13 +260657,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -270563,7 +260691,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -270602,6 +260730,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -270609,11 +260742,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -270637,7 +260765,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -270752,11 +260880,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -270827,11 +260951,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -270858,11 +260978,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -270915,7 +261031,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -270931,7 +261051,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -270960,8 +261080,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -271041,8 +261161,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -271059,11 +261179,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -271107,11 +261223,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -271153,11 +261265,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -271175,11 +261283,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -271195,8 +261299,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -271208,13 +261312,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -271248,11 +261352,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -271284,8 +261384,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -271376,11 +261476,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -271403,11 +261499,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -271461,7 +261553,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -271488,7 +261580,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -271504,11 +261596,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -271547,11 +261635,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -271598,8 +261682,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -271620,8 +261704,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -271670,7 +261754,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -271735,13 +261819,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -271769,7 +261853,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -271808,6 +261892,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -271815,11 +261904,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -271843,7 +261927,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -271958,11 +262042,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -272033,11 +262113,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -272064,11 +262140,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -272121,7 +262193,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -272137,7 +262213,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -272166,8 +262242,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -272247,8 +262323,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -272265,11 +262341,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -272313,11 +262385,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -272359,11 +262427,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -272381,11 +262445,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -272401,8 +262461,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -272414,13 +262474,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -272454,11 +262514,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -272490,8 +262546,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -272582,11 +262638,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -272609,11 +262661,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -272667,7 +262715,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -272694,7 +262742,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -272710,11 +262758,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -272753,11 +262797,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -272804,8 +262844,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -272826,8 +262866,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -272876,7 +262916,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -272941,13 +262981,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -272975,7 +263015,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -273014,6 +263054,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -273021,11 +263066,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -273049,7 +263089,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -273164,11 +263204,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -273239,11 +263275,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -273270,11 +263302,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -273327,7 +263355,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -273343,7 +263375,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -273372,8 +263404,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -273453,8 +263485,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -273471,11 +263503,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -273519,11 +263547,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -273565,11 +263589,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -273587,11 +263607,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -273607,8 +263623,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -273620,13 +263636,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -273660,11 +263676,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -273696,8 +263708,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -273788,11 +263800,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -273815,11 +263823,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -273873,7 +263877,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -273900,7 +263904,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -273916,11 +263920,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -273959,11 +263959,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -274010,8 +264006,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -274032,8 +264028,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -274082,7 +264078,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -274147,13 +264143,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -274181,7 +264177,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -274220,6 +264216,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -274227,11 +264228,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -274255,7 +264251,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -274370,11 +264366,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -274445,11 +264437,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -274476,11 +264464,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -274533,7 +264517,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -274549,7 +264537,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -274578,8 +264566,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -274659,8 +264647,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -274677,11 +264665,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -274725,11 +264709,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -274771,11 +264751,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -274793,11 +264769,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -274813,8 +264785,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -274826,13 +264798,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -274866,11 +264838,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -274902,8 +264870,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -274994,11 +264962,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -275021,11 +264985,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -275079,7 +265039,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -275106,7 +265066,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -275122,11 +265082,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -275165,11 +265121,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -275216,8 +265168,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -275238,8 +265190,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -275288,7 +265240,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -275353,13 +265305,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -275387,7 +265339,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -275426,6 +265378,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -275433,11 +265390,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -275461,7 +265413,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -275576,11 +265528,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -275651,11 +265599,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -275682,11 +265626,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -275739,7 +265679,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -275755,7 +265699,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -275784,8 +265728,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -275865,8 +265809,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -275883,11 +265827,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -275931,11 +265871,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -275977,11 +265913,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -275999,11 +265931,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -276019,8 +265947,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -276032,13 +265960,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -276072,11 +266000,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -276108,8 +266032,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -276200,11 +266124,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -276227,11 +266147,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -276285,7 +266201,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -276312,7 +266228,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -276328,11 +266244,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -276371,11 +266283,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -276422,8 +266330,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -276444,8 +266352,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -276494,7 +266402,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -276559,13 +266467,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -276593,7 +266501,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -276632,6 +266540,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -276639,11 +266552,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -276667,7 +266575,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -276782,11 +266690,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -276857,11 +266761,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -276888,11 +266788,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -276945,7 +266841,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -276961,7 +266861,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -276990,8 +266890,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -277071,8 +266971,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -277089,11 +266989,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -277137,11 +267033,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -277183,11 +267075,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -277205,11 +267093,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -277225,8 +267109,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -277238,13 +267122,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -277278,11 +267162,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -277314,8 +267194,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -277406,11 +267286,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -277433,11 +267309,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -277491,7 +267363,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -277518,7 +267390,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -277534,11 +267406,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -277577,11 +267445,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -277628,8 +267492,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -277650,8 +267514,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -277700,7 +267564,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -277765,13 +267629,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -277799,7 +267663,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -277838,6 +267702,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -277845,11 +267714,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -277873,7 +267737,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -277988,11 +267852,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -278063,11 +267923,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -278094,11 +267950,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -278151,7 +268003,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -278167,7 +268023,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -278196,8 +268052,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -278277,8 +268133,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -278295,11 +268151,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -278343,11 +268195,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -278389,11 +268237,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -278411,11 +268255,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -278431,8 +268271,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -278444,13 +268284,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -278484,11 +268324,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -278520,8 +268356,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -278612,11 +268448,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -278639,11 +268471,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -278697,7 +268525,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -278724,7 +268552,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -278740,11 +268568,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -278783,11 +268607,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -278834,8 +268654,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -278856,8 +268676,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -278906,7 +268726,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -278971,13 +268791,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -279005,7 +268825,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -279044,6 +268864,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -279051,11 +268876,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -279079,7 +268899,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -279194,11 +269014,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -279269,11 +269085,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -279300,11 +269112,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -279357,7 +269165,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -279373,7 +269185,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -279402,8 +269214,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -279483,8 +269295,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -279501,11 +269313,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -279549,11 +269357,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -279595,11 +269399,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -279617,11 +269417,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -279637,8 +269433,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -279650,13 +269446,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -279690,11 +269486,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -279726,8 +269518,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -279818,11 +269610,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -279845,11 +269633,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -279903,7 +269687,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -279930,7 +269714,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -279946,11 +269730,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -279989,11 +269769,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -280040,8 +269816,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -280062,8 +269838,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -280112,7 +269888,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -280177,13 +269953,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -280211,7 +269987,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -280250,6 +270026,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -280257,11 +270038,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -280285,7 +270061,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -280400,11 +270176,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -280475,11 +270247,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -280506,11 +270274,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -280563,7 +270327,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -280579,7 +270347,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -280608,8 +270376,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -280689,8 +270457,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -280707,11 +270475,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -280755,11 +270519,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -280801,11 +270561,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -280823,11 +270579,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -280843,8 +270595,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -280856,13 +270608,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -280896,11 +270648,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -280932,8 +270680,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -281024,11 +270772,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -281051,11 +270795,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -281109,7 +270849,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -281136,7 +270876,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -281152,11 +270892,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -281195,11 +270931,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -281246,8 +270978,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -281268,8 +271000,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -281318,7 +271050,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -281383,13 +271115,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -281417,7 +271149,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -281456,6 +271188,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -281463,11 +271200,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -281491,7 +271223,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -281606,11 +271338,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -281681,11 +271409,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -281712,11 +271436,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -281769,7 +271489,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -281785,7 +271509,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -281814,8 +271538,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -281895,8 +271619,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -281913,11 +271637,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -281961,11 +271681,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -282007,11 +271723,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -282029,11 +271741,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -282049,8 +271757,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -282062,13 +271770,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -282102,11 +271810,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -282138,8 +271842,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -282230,11 +271934,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -282257,11 +271957,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -282315,7 +272011,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -282342,7 +272038,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -282358,11 +272054,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -282401,11 +272093,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -282452,8 +272140,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -282474,8 +272162,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -282524,7 +272212,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -282589,13 +272277,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -282623,7 +272311,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -282662,6 +272350,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -282669,11 +272362,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -282697,7 +272385,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -282812,11 +272500,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -282887,11 +272571,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -282918,11 +272598,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -282975,7 +272651,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -282991,7 +272671,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -283020,8 +272700,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -283101,8 +272781,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -283119,11 +272799,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -283167,11 +272843,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -283213,11 +272885,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -283235,11 +272903,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -283255,8 +272919,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -283268,13 +272932,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -283308,11 +272972,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -283344,8 +273004,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -283436,11 +273096,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -283463,11 +273119,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -283521,7 +273173,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -283548,7 +273200,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -283564,11 +273216,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -283607,11 +273255,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -283658,8 +273302,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -283680,8 +273324,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -283730,7 +273374,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -283795,13 +273439,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -283829,7 +273473,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -283868,6 +273512,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -283875,11 +273524,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -283903,7 +273547,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -284018,11 +273662,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -284093,11 +273733,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -284124,11 +273760,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -284181,7 +273813,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -284197,7 +273833,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -284226,8 +273862,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -284307,8 +273943,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -284325,11 +273961,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -284373,11 +274005,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -284419,11 +274047,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -284441,11 +274065,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -284461,8 +274081,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -284474,13 +274094,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -284514,11 +274134,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -284550,8 +274166,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -284642,11 +274258,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -284669,11 +274281,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -284727,7 +274335,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -284754,7 +274362,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -284770,11 +274378,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -284813,11 +274417,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -284864,8 +274464,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -284886,8 +274486,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -284936,7 +274536,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -285001,13 +274601,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -285035,7 +274635,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -285074,6 +274674,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -285081,11 +274686,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -285109,7 +274709,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -285224,11 +274824,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -285299,11 +274895,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -285330,11 +274922,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -285387,7 +274975,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -285403,7 +274995,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -285432,8 +275024,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -285513,8 +275105,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -285531,11 +275123,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -285579,11 +275167,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -285625,11 +275209,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -285647,11 +275227,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -285667,8 +275243,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -285680,13 +275256,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -285720,11 +275296,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -285756,8 +275328,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -285848,11 +275420,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -285875,11 +275443,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -285933,7 +275497,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -285960,7 +275524,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -285976,11 +275540,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -286019,11 +275579,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -286070,8 +275626,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -286092,8 +275648,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -286142,7 +275698,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -286207,13 +275763,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -286241,7 +275797,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -286280,6 +275836,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -286287,11 +275848,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -286315,7 +275871,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -286430,11 +275986,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -286505,11 +276057,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -286536,11 +276084,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -286593,7 +276137,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -286609,7 +276157,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -286638,8 +276186,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -286719,8 +276267,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -286737,11 +276285,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -286785,11 +276329,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -286831,11 +276371,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -286853,11 +276389,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -286873,8 +276405,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -286886,13 +276418,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -286926,11 +276458,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -286962,8 +276490,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -287054,11 +276582,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -287081,11 +276605,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -287139,7 +276659,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -287166,7 +276686,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -287182,11 +276702,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -287225,11 +276741,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -287276,8 +276788,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -287298,8 +276810,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -287348,7 +276860,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -287413,13 +276925,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -287447,7 +276959,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -287486,6 +276998,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -287493,11 +277010,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -287521,7 +277033,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -287636,11 +277148,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -287711,11 +277219,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -287742,11 +277246,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -287799,7 +277299,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -287815,7 +277319,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -287844,8 +277348,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -287925,8 +277429,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -287943,11 +277447,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -287991,11 +277491,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -288037,11 +277533,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -288059,11 +277551,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -288079,8 +277567,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -288092,13 +277580,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -288132,11 +277620,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -288168,8 +277652,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -288260,11 +277744,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -288287,11 +277767,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -288345,7 +277821,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -288372,7 +277848,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -288388,11 +277864,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -288431,11 +277903,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -288482,8 +277950,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -288504,8 +277972,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -288554,7 +278022,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -288619,13 +278087,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -288653,7 +278121,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -288692,6 +278160,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -288699,11 +278172,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -288727,7 +278195,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -288842,11 +278310,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -288917,11 +278381,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -288948,11 +278408,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -289005,7 +278461,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -289021,7 +278481,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -289050,8 +278510,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -289131,8 +278591,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -289149,11 +278609,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -289197,11 +278653,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -289243,11 +278695,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -289265,11 +278713,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -289285,8 +278729,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -289298,13 +278742,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -289338,11 +278782,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -289374,8 +278814,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -289466,11 +278906,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -289493,11 +278929,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -289551,7 +278983,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -289578,7 +279010,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -289594,11 +279026,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -289637,11 +279065,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -289688,8 +279112,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -289710,8 +279134,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -289760,7 +279184,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -289825,13 +279249,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -289859,7 +279283,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -289898,6 +279322,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -289905,11 +279334,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -289933,7 +279357,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -290048,11 +279472,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -290123,11 +279543,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -290154,11 +279570,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -290211,7 +279623,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -290227,7 +279643,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -290256,8 +279672,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -290337,8 +279753,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -290355,11 +279771,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -290403,11 +279815,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -290449,11 +279857,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -290471,11 +279875,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -290491,8 +279891,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -290504,13 +279904,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -290544,11 +279944,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -290580,8 +279976,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -290672,11 +280068,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -290699,11 +280091,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -290757,7 +280145,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -290784,7 +280172,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -290800,11 +280188,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -290843,11 +280227,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -290894,8 +280274,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -290916,8 +280296,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -290966,7 +280346,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -291031,13 +280411,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -291065,7 +280445,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -291104,6 +280484,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -291111,11 +280496,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -291139,7 +280519,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -291254,11 +280634,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -291329,11 +280705,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -291360,11 +280732,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -291417,7 +280785,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -291433,7 +280805,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -291462,8 +280834,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -291543,8 +280915,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -291561,11 +280933,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -291609,11 +280977,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -291655,11 +281019,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -291677,11 +281037,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -291697,8 +281053,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -291710,13 +281066,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -291750,11 +281106,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -291786,8 +281138,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -291878,11 +281230,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -291905,11 +281253,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -291963,7 +281307,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -291990,7 +281334,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -292006,11 +281350,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -292049,11 +281389,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -292100,8 +281436,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -292122,8 +281458,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -292172,7 +281508,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -292237,13 +281573,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -292271,7 +281607,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -292310,6 +281646,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -292317,11 +281658,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -292345,7 +281681,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -292460,11 +281796,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -292535,11 +281867,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -292566,11 +281894,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -292623,7 +281947,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -292639,7 +281967,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -292668,8 +281996,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -292749,8 +282077,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -292767,11 +282095,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -292815,11 +282139,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -292861,11 +282181,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -292883,11 +282199,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -292903,8 +282215,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -292916,13 +282228,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -292956,11 +282268,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -292992,8 +282300,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -293084,11 +282392,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -293111,11 +282415,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -293169,7 +282469,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -293196,7 +282496,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -293212,11 +282512,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -293255,11 +282551,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -293306,8 +282598,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -293328,8 +282620,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -293378,7 +282670,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -293443,13 +282735,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -293477,7 +282769,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -293516,6 +282808,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -293523,11 +282820,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -293551,7 +282843,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -293666,11 +282958,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -293741,11 +283029,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -293772,11 +283056,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -293829,7 +283109,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -293845,7 +283129,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -293874,8 +283158,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -293955,8 +283239,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -293973,11 +283257,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -294021,11 +283301,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -294067,11 +283343,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -294089,11 +283361,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -294109,8 +283377,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -294122,13 +283390,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -294162,11 +283430,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -294198,8 +283462,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -294290,11 +283554,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -294317,11 +283577,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -294375,7 +283631,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -294402,7 +283658,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -294418,11 +283674,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -294461,11 +283713,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -294512,8 +283760,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -294534,8 +283782,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -294584,7 +283832,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -294649,13 +283897,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -294683,7 +283931,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -294722,6 +283970,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -294729,11 +283982,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -294757,7 +284005,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -294872,11 +284120,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -294947,11 +284191,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -294978,11 +284218,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -295035,7 +284271,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -295051,7 +284291,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -295080,8 +284320,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -295161,8 +284401,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -295179,11 +284419,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -295227,11 +284463,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -295273,11 +284505,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -295295,11 +284523,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -295315,8 +284539,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -295328,13 +284552,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -295368,11 +284592,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -295404,8 +284624,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -295496,11 +284716,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -295523,11 +284739,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -295581,7 +284793,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -295608,7 +284820,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -295624,11 +284836,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -295667,11 +284875,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -295718,8 +284922,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -295740,8 +284944,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -295790,7 +284994,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -295855,13 +285059,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -295889,7 +285093,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -295928,6 +285132,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -295935,11 +285144,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -295963,7 +285167,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -296078,11 +285282,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -296153,11 +285353,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -296184,11 +285380,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -296241,7 +285433,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -296257,7 +285453,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -296286,8 +285482,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -296367,8 +285563,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -296385,11 +285581,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -296433,11 +285625,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -296479,11 +285667,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -296501,11 +285685,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -296521,8 +285701,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -296534,13 +285714,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -296574,11 +285754,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -296610,8 +285786,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -296702,11 +285878,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -296729,11 +285901,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -296787,7 +285955,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -296814,7 +285982,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -296830,11 +285998,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -296873,11 +286037,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -296924,8 +286084,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -296946,8 +286106,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -296996,7 +286156,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -297061,13 +286221,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -297095,7 +286255,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -297134,6 +286294,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -297141,11 +286306,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -297169,7 +286329,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -297284,11 +286444,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -297359,11 +286515,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -297390,11 +286542,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -297447,7 +286595,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -297463,7 +286615,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -297492,8 +286644,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -297573,8 +286725,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -297591,11 +286743,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -297639,11 +286787,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -297685,11 +286829,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -297707,11 +286847,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -297727,8 +286863,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -297740,13 +286876,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -297780,11 +286916,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -297816,8 +286948,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -297908,11 +287040,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -297935,11 +287063,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -297993,7 +287117,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -298020,7 +287144,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -298036,11 +287160,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -298079,11 +287199,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -298130,8 +287246,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -298152,8 +287268,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -298202,7 +287318,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -298267,13 +287383,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -298301,7 +287417,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -298340,6 +287456,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -298347,11 +287468,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -298375,7 +287491,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -298490,11 +287606,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -298565,11 +287677,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -298596,11 +287704,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -298653,7 +287757,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -298669,7 +287777,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -298698,8 +287806,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -298779,8 +287887,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -298797,11 +287905,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -298845,11 +287949,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -298891,11 +287991,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -298913,11 +288009,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -298933,8 +288025,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -298946,13 +288038,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -298986,11 +288078,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -299022,8 +288110,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -299114,11 +288202,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -299141,11 +288225,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -299199,7 +288279,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -299226,7 +288306,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -299242,11 +288322,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -299285,11 +288361,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -299336,8 +288408,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -299358,8 +288430,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -299408,7 +288480,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -299473,13 +288545,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -299507,7 +288579,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -299546,6 +288618,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -299553,11 +288630,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -299581,7 +288653,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -299696,11 +288768,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -299771,11 +288839,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -299802,11 +288866,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -299859,7 +288919,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -299875,7 +288939,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -299904,8 +288968,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -299985,8 +289049,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -300003,11 +289067,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -300051,11 +289111,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -300097,11 +289153,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -300119,11 +289171,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -300139,8 +289187,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -300152,13 +289200,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -300192,11 +289240,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -300228,8 +289272,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -300320,11 +289364,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -300347,11 +289387,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -300405,7 +289441,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -300432,7 +289468,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -300448,11 +289484,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -300491,11 +289523,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -300542,8 +289570,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -300564,8 +289592,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -300614,7 +289642,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -300679,13 +289707,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -300713,7 +289741,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -300752,6 +289780,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -300759,11 +289792,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -300787,7 +289815,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -300902,11 +289930,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -300977,11 +290001,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -301008,11 +290028,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -301065,7 +290081,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -301081,7 +290101,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -301110,8 +290130,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -301191,8 +290211,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -301209,11 +290229,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -301257,11 +290273,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -301303,11 +290315,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -301325,11 +290333,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -301345,8 +290349,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -301358,13 +290362,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -301398,11 +290402,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -301434,8 +290434,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -301526,11 +290526,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -301553,11 +290549,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -301611,7 +290603,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -301638,7 +290630,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -301654,11 +290646,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -301697,11 +290685,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -301748,8 +290732,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -301770,8 +290754,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -301820,7 +290804,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -301885,13 +290869,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -301919,7 +290903,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -301958,6 +290942,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -301965,11 +290954,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -301993,7 +290977,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -302108,11 +291092,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -302183,11 +291163,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -302214,11 +291190,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -302271,7 +291243,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -302287,7 +291263,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -302316,8 +291292,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -302397,8 +291373,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -302415,11 +291391,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -302463,11 +291435,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -302509,11 +291477,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -302531,11 +291495,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -302551,8 +291511,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -302564,13 +291524,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -302604,11 +291564,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -302640,8 +291596,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -302732,11 +291688,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -302759,11 +291711,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -302817,7 +291765,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -302844,7 +291792,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -302860,11 +291808,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -302903,11 +291847,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -302954,8 +291894,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -302976,8 +291916,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -303026,7 +291966,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -303091,13 +292031,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -303125,7 +292065,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -303164,6 +292104,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -303171,11 +292116,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -303199,7 +292139,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -303314,11 +292254,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -303389,11 +292325,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -303420,11 +292352,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -303477,7 +292405,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -303493,7 +292425,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -303522,8 +292454,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -303603,8 +292535,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -303621,11 +292553,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -303669,11 +292597,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -303715,11 +292639,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -303737,11 +292657,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -303757,8 +292673,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -303770,13 +292686,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -303810,11 +292726,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -303846,8 +292758,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -303938,11 +292850,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -303965,11 +292873,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -304023,7 +292927,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -304050,7 +292954,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -304066,11 +292970,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -304109,11 +293009,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -304160,8 +293056,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -304182,8 +293078,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -304232,7 +293128,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -304297,13 +293193,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -304331,7 +293227,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -304370,6 +293266,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -304377,11 +293278,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -304405,7 +293301,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -304520,11 +293416,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -304595,11 +293487,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -304626,11 +293514,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -304683,7 +293567,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -304699,7 +293587,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -304728,8 +293616,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -304809,8 +293697,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -304827,11 +293715,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -304875,11 +293759,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -304921,11 +293801,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -304943,11 +293819,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -304963,8 +293835,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -304976,13 +293848,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -305016,11 +293888,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -305052,8 +293920,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -305144,11 +294012,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -305171,11 +294035,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -305229,7 +294089,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -305256,7 +294116,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -305272,11 +294132,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -305315,11 +294171,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -305366,8 +294218,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -305388,8 +294240,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -305438,7 +294290,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -305503,13 +294355,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -305537,7 +294389,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -305576,6 +294428,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -305583,11 +294440,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -305611,7 +294463,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -305726,11 +294578,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -305801,11 +294649,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -305832,11 +294676,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -305889,7 +294729,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -305905,7 +294749,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -305934,8 +294778,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -306015,8 +294859,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -306033,11 +294877,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -306081,11 +294921,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -306127,11 +294963,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -306149,11 +294981,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -306169,8 +294997,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -306182,13 +295010,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -306222,11 +295050,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -306258,8 +295082,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -306350,11 +295174,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -306377,11 +295197,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -306435,7 +295251,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -306462,7 +295278,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -306478,11 +295294,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -306521,11 +295333,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -306572,8 +295380,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -306594,8 +295402,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -306644,7 +295452,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -306709,13 +295517,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -306743,7 +295551,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -306782,6 +295590,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -306789,11 +295602,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -306817,7 +295625,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -306932,11 +295740,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -307007,11 +295811,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -307038,11 +295838,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -307095,7 +295891,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -307111,7 +295911,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -307140,8 +295940,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -307221,8 +296021,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -307239,11 +296039,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -307287,11 +296083,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -307333,11 +296125,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -307355,11 +296143,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -307375,8 +296159,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -307388,13 +296172,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -307428,11 +296212,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -307464,8 +296244,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -307556,11 +296336,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -307583,11 +296359,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -307641,7 +296413,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -307668,7 +296440,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -307684,11 +296456,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -307727,11 +296495,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -307778,8 +296542,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -307800,8 +296564,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -307850,7 +296614,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -307915,13 +296679,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -307949,7 +296713,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -307988,6 +296752,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -307995,11 +296764,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -308023,7 +296787,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -308138,11 +296902,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -308213,11 +296973,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -308244,11 +297000,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -308301,7 +297053,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -308317,7 +297073,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -308346,8 +297102,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -308427,8 +297183,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -308445,11 +297201,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -308493,11 +297245,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -308539,11 +297287,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -308561,11 +297305,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -308581,8 +297321,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -308594,13 +297334,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -308634,11 +297374,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -308670,8 +297406,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -308762,11 +297498,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -308789,11 +297521,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -308847,7 +297575,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -308874,7 +297602,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -308890,11 +297618,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -308933,11 +297657,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -308984,8 +297704,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -309006,8 +297726,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -309056,7 +297776,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -309121,13 +297841,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -309155,7 +297875,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -309194,6 +297914,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -309201,11 +297926,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -309229,7 +297949,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -309344,11 +298064,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -309419,11 +298135,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -309450,11 +298162,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -309507,7 +298215,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -309523,7 +298235,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -309552,8 +298264,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -309633,8 +298345,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -309651,11 +298363,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -309699,11 +298407,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -309745,11 +298449,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -309767,11 +298467,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -309787,8 +298483,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -309800,13 +298496,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -309840,11 +298536,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -309876,8 +298568,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -309968,11 +298660,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -309995,11 +298683,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -310053,7 +298737,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -310080,7 +298764,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -310096,11 +298780,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -310139,11 +298819,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -310190,8 +298866,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -310212,8 +298888,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -310262,7 +298938,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -310327,13 +299003,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -310361,7 +299037,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -310400,6 +299076,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -310407,11 +299088,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -310435,7 +299111,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -310550,11 +299226,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -310625,11 +299297,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -310656,11 +299324,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -310713,7 +299377,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -310729,7 +299397,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -310758,8 +299426,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -310839,8 +299507,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -310857,11 +299525,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -310905,11 +299569,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -310951,11 +299611,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -310973,11 +299629,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -310993,8 +299645,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -311006,13 +299658,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -311046,11 +299698,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -311082,8 +299730,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -311174,11 +299822,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -311201,11 +299845,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -311259,7 +299899,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -311286,7 +299926,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -311302,11 +299942,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -311345,11 +299981,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -311396,8 +300028,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -311418,8 +300050,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -311468,7 +300100,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -311533,13 +300165,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -311567,7 +300199,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -311606,6 +300238,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -311613,11 +300250,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -311641,7 +300273,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -311756,11 +300388,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -311831,11 +300459,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -311862,11 +300486,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -311919,7 +300539,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -311935,7 +300559,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -311964,8 +300588,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -312045,8 +300669,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -312063,11 +300687,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -312111,11 +300731,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -312157,11 +300773,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -312179,11 +300791,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -312199,8 +300807,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -312212,13 +300820,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -312252,11 +300860,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -312288,8 +300892,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -312380,11 +300984,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -312407,11 +301007,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -312465,7 +301061,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -312492,7 +301088,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -312508,11 +301104,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -312551,11 +301143,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -312602,8 +301190,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -312624,8 +301212,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -312674,7 +301262,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -312739,13 +301327,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -312773,7 +301361,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -312812,6 +301400,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -312819,11 +301412,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -312847,7 +301435,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -312962,11 +301550,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -313037,11 +301621,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -313068,11 +301648,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -313125,7 +301701,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -313141,7 +301721,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -313170,8 +301750,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -313251,8 +301831,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -313269,11 +301849,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -313317,11 +301893,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -313363,11 +301935,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -313385,11 +301953,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -313405,8 +301969,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -313418,13 +301982,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -313458,11 +302022,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -313494,8 +302054,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -313586,11 +302146,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -313613,11 +302169,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -313671,7 +302223,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -313698,7 +302250,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -313714,11 +302266,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -313757,11 +302305,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -313808,8 +302352,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -313830,8 +302374,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -313880,7 +302424,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -313945,13 +302489,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -313979,7 +302523,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -314018,6 +302562,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -314025,11 +302574,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -314053,7 +302597,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -314168,11 +302712,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -314243,11 +302783,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -314274,11 +302810,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -314331,7 +302863,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -314347,7 +302883,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -314376,8 +302912,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -314457,8 +302993,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -314475,11 +303011,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -314523,11 +303055,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -314569,11 +303097,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -314591,11 +303115,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -314611,8 +303131,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -314624,13 +303144,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -314664,11 +303184,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -314700,8 +303216,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -314792,11 +303308,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -314819,11 +303331,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -314877,7 +303385,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -314904,7 +303412,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -314920,11 +303428,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -314963,11 +303467,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -315014,8 +303514,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -315036,8 +303536,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -315086,7 +303586,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -315151,13 +303651,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -315185,7 +303685,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -315224,6 +303724,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -315231,11 +303736,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -315259,7 +303759,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -315374,11 +303874,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -315449,11 +303945,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -315480,11 +303972,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -315537,7 +304025,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -315553,7 +304045,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -315582,8 +304074,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -315663,8 +304155,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -315681,11 +304173,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -315729,11 +304217,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -315775,11 +304259,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -315797,11 +304277,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -315817,8 +304293,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -315830,13 +304306,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -315870,11 +304346,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -315906,8 +304378,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -315998,11 +304470,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -316025,11 +304493,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -316083,7 +304547,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -316110,7 +304574,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -316126,11 +304590,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -316169,11 +304629,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -316220,8 +304676,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -316242,8 +304698,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -316292,7 +304748,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -316357,13 +304813,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -316391,7 +304847,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -316430,6 +304886,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -316437,11 +304898,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -316465,7 +304921,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -316580,11 +305036,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -316655,11 +305107,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -316686,11 +305134,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -316743,7 +305187,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -316759,7 +305207,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -316788,8 +305236,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -316869,8 +305317,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -316887,11 +305335,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -316935,11 +305379,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -316981,11 +305421,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -317003,11 +305439,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -317023,8 +305455,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -317036,13 +305468,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -317076,11 +305508,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -317112,8 +305540,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -317204,11 +305632,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -317231,11 +305655,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -317289,7 +305709,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -317316,7 +305736,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -317332,11 +305752,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -317375,11 +305791,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -317426,8 +305838,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -317448,8 +305860,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -317498,7 +305910,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -317563,13 +305975,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -317597,7 +306009,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -317636,6 +306048,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -317643,11 +306060,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -317671,7 +306083,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -317786,11 +306198,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -317861,11 +306269,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -317892,11 +306296,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -317949,7 +306349,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -317965,7 +306369,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -317994,8 +306398,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -318075,8 +306479,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -318093,11 +306497,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -318141,11 +306541,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -318187,11 +306583,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -318209,11 +306601,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -318229,8 +306617,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -318242,13 +306630,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -318282,11 +306670,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -318318,8 +306702,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -318410,11 +306794,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -318437,11 +306817,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -318495,7 +306871,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -318522,7 +306898,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -318538,11 +306914,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -318581,11 +306953,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -318632,8 +307000,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -318654,8 +307022,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -318704,7 +307072,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -318769,13 +307137,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -318803,7 +307171,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -318842,6 +307210,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -318849,11 +307222,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -318877,7 +307245,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -318992,11 +307360,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -319067,11 +307431,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -319098,11 +307458,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -319155,7 +307511,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -319171,7 +307531,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -319200,8 +307560,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -319281,8 +307641,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -319299,11 +307659,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -319347,11 +307703,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -319393,11 +307745,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -319415,11 +307763,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -319435,8 +307779,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -319448,13 +307792,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -319488,11 +307832,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -319524,8 +307864,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -319616,11 +307956,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -319643,11 +307979,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -319701,7 +308033,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -319728,7 +308060,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -319744,11 +308076,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -319787,11 +308115,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -319838,8 +308162,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -319860,8 +308184,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -319910,7 +308234,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -319975,13 +308299,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -320009,7 +308333,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -320048,6 +308372,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -320055,11 +308384,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -320083,7 +308407,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -320198,11 +308522,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -320273,11 +308593,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -320304,11 +308620,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -320361,7 +308673,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -320377,7 +308693,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -320406,8 +308722,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -320487,8 +308803,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -320505,11 +308821,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -320553,11 +308865,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -320599,11 +308907,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -320621,11 +308925,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -320641,8 +308941,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -320654,13 +308954,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -320694,11 +308994,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -320730,8 +309026,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -320822,11 +309118,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -320849,11 +309141,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -320907,7 +309195,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -320934,7 +309222,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -320950,11 +309238,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -320993,11 +309277,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -321044,8 +309324,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -321066,8 +309346,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -321116,7 +309396,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -321181,13 +309461,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -321215,7 +309495,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -321254,6 +309534,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -321261,11 +309546,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -321289,7 +309569,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -321404,11 +309684,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -321479,11 +309755,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -321510,11 +309782,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -321567,7 +309835,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -321583,7 +309855,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -321612,8 +309884,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -321693,8 +309965,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -321711,11 +309983,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -321759,11 +310027,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -321805,11 +310069,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -321827,11 +310087,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -321847,8 +310103,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -321860,13 +310116,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -321900,11 +310156,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -321936,8 +310188,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -322028,11 +310280,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -322055,11 +310303,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -322113,7 +310357,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -322140,7 +310384,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -322156,11 +310400,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -322199,11 +310439,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -322250,8 +310486,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -322272,8 +310508,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -322322,7 +310558,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -322387,13 +310623,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -322421,7 +310657,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -322460,6 +310696,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -322467,11 +310708,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -322495,7 +310731,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -322610,11 +310846,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -322685,11 +310917,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -322716,11 +310944,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -322773,7 +310997,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -322789,7 +311017,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -322818,8 +311046,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -322899,8 +311127,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -322917,11 +311145,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -322965,11 +311189,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -323011,11 +311231,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -323033,11 +311249,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -323053,8 +311265,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -323066,13 +311278,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -323106,11 +311318,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -323142,8 +311350,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -323234,11 +311442,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -323261,11 +311465,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -323319,7 +311519,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -323346,7 +311546,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -323362,11 +311562,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -323405,11 +311601,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -323456,8 +311648,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -323478,8 +311670,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -323528,7 +311720,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -323593,13 +311785,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -323627,7 +311819,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -323666,6 +311858,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -323673,11 +311870,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -323701,7 +311893,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -323816,11 +312008,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -323891,11 +312079,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -323922,11 +312106,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -323979,7 +312159,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -323995,7 +312179,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -324024,8 +312208,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -324105,8 +312289,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -324123,11 +312307,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -324171,11 +312351,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -324217,11 +312393,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -324239,11 +312411,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -324259,8 +312427,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -324272,13 +312440,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -324312,11 +312480,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -324348,8 +312512,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -324440,11 +312604,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -324467,11 +312627,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -324525,7 +312681,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -324552,7 +312708,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -324568,11 +312724,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -324611,11 +312763,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -324662,8 +312810,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -324684,8 +312832,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -324734,7 +312882,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -324799,13 +312947,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -324833,7 +312981,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -324872,6 +313020,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -324879,11 +313032,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -324907,7 +313055,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -325022,11 +313170,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -325097,11 +313241,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -325128,11 +313268,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -325185,7 +313321,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -325201,7 +313341,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -325230,8 +313370,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -325311,8 +313451,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -325329,11 +313469,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -325377,11 +313513,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -325423,11 +313555,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -325445,11 +313573,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -325465,8 +313589,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -325478,13 +313602,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -325518,11 +313642,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -325554,8 +313674,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -325646,11 +313766,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -325673,11 +313789,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -325731,7 +313843,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -325758,7 +313870,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -325774,11 +313886,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -325817,11 +313925,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -325868,8 +313972,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -325890,8 +313994,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -325940,7 +314044,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -326005,13 +314109,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -326039,7 +314143,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -326078,6 +314182,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -326085,11 +314194,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -326113,7 +314217,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -326228,11 +314332,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -326303,11 +314403,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -326334,11 +314430,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -326391,7 +314483,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -326407,7 +314503,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -326436,8 +314532,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -326517,8 +314613,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -326535,11 +314631,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -326583,11 +314675,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -326629,11 +314717,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -326651,11 +314735,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -326671,8 +314751,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -326684,13 +314764,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -326724,11 +314804,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -326760,8 +314836,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -326852,11 +314928,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -326879,11 +314951,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -326937,7 +315005,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -326964,7 +315032,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -326980,11 +315048,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -327023,11 +315087,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -327074,8 +315134,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -327096,8 +315156,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -327146,7 +315206,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -327211,13 +315271,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -327245,7 +315305,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -327284,6 +315344,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -327291,11 +315356,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -327319,7 +315379,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -327434,11 +315494,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -327509,11 +315565,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -327540,11 +315592,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -327597,7 +315645,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -327613,7 +315665,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -327642,8 +315694,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -327723,8 +315775,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -327741,11 +315793,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -327789,11 +315837,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -327835,11 +315879,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -327857,11 +315897,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -327877,8 +315913,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -327890,13 +315926,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -327930,11 +315966,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -327966,8 +315998,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -328058,11 +316090,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -328085,11 +316113,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -328143,7 +316167,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -328170,7 +316194,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -328186,11 +316210,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -328229,11 +316249,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -328280,8 +316296,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -328302,8 +316318,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -328352,7 +316368,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -328417,13 +316433,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -328451,7 +316467,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -328490,6 +316506,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -328497,11 +316518,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -328525,7 +316541,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -328640,11 +316656,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -328715,11 +316727,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -328746,11 +316754,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -328803,7 +316807,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -328819,7 +316827,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -328848,8 +316856,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -328929,8 +316937,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -328947,11 +316955,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -328995,11 +316999,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -329041,11 +317041,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -329063,11 +317059,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -329083,8 +317075,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -329096,13 +317088,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -329136,11 +317128,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -329172,8 +317160,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -329264,11 +317252,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -329291,11 +317275,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -329349,7 +317329,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -329376,7 +317356,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -329392,11 +317372,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -329435,11 +317411,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -329486,8 +317458,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -329508,8 +317480,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -329558,7 +317530,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -329623,13 +317595,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -329657,7 +317629,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -329696,6 +317668,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -329703,11 +317680,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -329731,7 +317703,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -329846,11 +317818,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -329921,11 +317889,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -329952,11 +317916,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -330009,7 +317969,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -330025,7 +317989,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -330054,8 +318018,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -330135,8 +318099,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -330153,11 +318117,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -330201,11 +318161,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -330247,11 +318203,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -330269,11 +318221,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -330289,8 +318237,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -330302,13 +318250,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -330342,11 +318290,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -330378,8 +318322,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -330470,11 +318414,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -330497,11 +318437,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -330555,7 +318491,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -330582,7 +318518,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -330598,11 +318534,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -330641,11 +318573,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -330692,8 +318620,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -330714,8 +318642,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -330764,7 +318692,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -330829,13 +318757,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -330863,7 +318791,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -330902,6 +318830,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -330909,11 +318842,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -330937,7 +318865,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -331052,11 +318980,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -331127,11 +319051,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -331158,11 +319078,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -331215,7 +319131,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -331231,7 +319151,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -331260,8 +319180,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -331341,8 +319261,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -331359,11 +319279,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -331407,11 +319323,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -331453,11 +319365,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -331475,11 +319383,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -331495,8 +319399,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -331508,13 +319412,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -331548,11 +319452,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -331584,8 +319484,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -331676,11 +319576,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -331703,11 +319599,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -331761,7 +319653,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -331788,7 +319680,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -331804,11 +319696,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -331847,11 +319735,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -331898,8 +319782,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -331920,8 +319804,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -331970,7 +319854,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -332035,13 +319919,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -332069,7 +319953,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -332108,6 +319992,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -332115,11 +320004,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -332143,7 +320027,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -332258,11 +320142,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -332333,11 +320213,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -332364,11 +320240,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -332421,7 +320293,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -332437,7 +320313,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -332466,8 +320342,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -332547,8 +320423,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -332565,11 +320441,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -332613,11 +320485,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -332659,11 +320527,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -332681,11 +320545,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -332701,8 +320561,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -332714,13 +320574,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -332754,11 +320614,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -332790,8 +320646,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -332882,11 +320738,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -332909,11 +320761,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -332967,7 +320815,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -332994,7 +320842,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -333010,11 +320858,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -333053,11 +320897,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -333104,8 +320944,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -333126,8 +320966,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -333176,7 +321016,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -333241,13 +321081,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -333275,7 +321115,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -333314,6 +321154,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -333321,11 +321166,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -333349,7 +321189,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -333464,11 +321304,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -333539,11 +321375,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -333570,11 +321402,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -333627,7 +321455,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -333643,7 +321475,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -333672,8 +321504,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -333753,8 +321585,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -333771,11 +321603,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -333819,11 +321647,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -333865,11 +321689,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -333887,11 +321707,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -333907,8 +321723,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -333920,13 +321736,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -333960,11 +321776,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -333996,8 +321808,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -334088,11 +321900,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -334115,11 +321923,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -334173,7 +321977,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -334200,7 +322004,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -334216,11 +322020,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -334259,11 +322059,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -334310,8 +322106,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -334332,8 +322128,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -334382,7 +322178,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -334447,13 +322243,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -334481,7 +322277,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -334520,6 +322316,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -334527,11 +322328,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -334555,7 +322351,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -334670,11 +322466,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -334745,11 +322537,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -334776,11 +322564,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -334833,7 +322617,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -334849,7 +322637,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -334878,8 +322666,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -334959,8 +322747,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -334977,11 +322765,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -335025,11 +322809,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -335071,11 +322851,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -335093,11 +322869,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -335113,8 +322885,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -335126,13 +322898,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -335166,11 +322938,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -335202,8 +322970,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -335294,11 +323062,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -335321,11 +323085,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -335379,7 +323139,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -335406,7 +323166,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -335422,11 +323182,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -335465,11 +323221,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -335516,8 +323268,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -335538,8 +323290,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -335588,7 +323340,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -335653,13 +323405,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -335687,7 +323439,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -335726,6 +323478,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -335733,11 +323490,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -335761,7 +323513,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -335876,11 +323628,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -335951,11 +323699,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -335982,11 +323726,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -336039,7 +323779,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -336055,7 +323799,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -336084,8 +323828,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -336165,8 +323909,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -336183,11 +323927,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -336231,11 +323971,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -336277,11 +324013,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -336299,11 +324031,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -336319,8 +324047,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -336332,13 +324060,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -336372,11 +324100,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -336408,8 +324132,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -336500,11 +324224,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -336527,11 +324247,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -336585,7 +324301,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -336612,7 +324328,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -336628,11 +324344,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -336671,11 +324383,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -336722,8 +324430,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -336744,8 +324452,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -336794,7 +324502,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -336859,13 +324567,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -336893,7 +324601,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -336932,6 +324640,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -336939,11 +324652,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -336967,7 +324675,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -337082,11 +324790,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -337157,11 +324861,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -337188,11 +324888,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -337245,7 +324941,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -337261,7 +324961,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -337290,8 +324990,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -337371,8 +325071,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -337389,11 +325089,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -337437,11 +325133,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -337483,11 +325175,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -337505,11 +325193,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -337525,8 +325209,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -337538,13 +325222,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -337578,11 +325262,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -337614,8 +325294,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -337706,11 +325386,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -337733,11 +325409,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -337791,7 +325463,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -337818,7 +325490,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -337834,11 +325506,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -337877,11 +325545,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -337928,8 +325592,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -337950,8 +325614,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -338000,7 +325664,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -338065,13 +325729,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -338099,7 +325763,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -338138,6 +325802,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -338145,11 +325814,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -338173,7 +325837,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -338288,11 +325952,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -338363,11 +326023,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -338394,11 +326050,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -338451,7 +326103,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -338467,7 +326123,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -338496,8 +326152,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -338577,8 +326233,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -338595,11 +326251,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -338643,11 +326295,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -338689,11 +326337,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -338711,11 +326355,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -338731,8 +326371,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -338744,13 +326384,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -338784,11 +326424,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -338820,8 +326456,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -338912,11 +326548,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -338939,11 +326571,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -338997,7 +326625,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -339024,7 +326652,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -339040,11 +326668,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -339083,11 +326707,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -339134,8 +326754,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -339156,8 +326776,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -339206,7 +326826,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -339271,13 +326891,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -339305,7 +326925,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -339344,6 +326964,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -339351,11 +326976,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -339379,7 +326999,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -339494,11 +327114,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -339569,11 +327185,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -339600,11 +327212,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -339657,7 +327265,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -339673,7 +327285,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -339702,8 +327314,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -339783,8 +327395,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -339801,11 +327413,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -339849,11 +327457,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -339895,11 +327499,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -339917,11 +327517,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -339937,8 +327533,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -339950,13 +327546,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -339990,11 +327586,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -340026,8 +327618,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -340118,11 +327710,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -340145,11 +327733,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -340203,7 +327787,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -340230,7 +327814,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -340246,11 +327830,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -340289,11 +327869,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -340340,8 +327916,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -340362,8 +327938,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -340412,7 +327988,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -340477,13 +328053,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -340511,7 +328087,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -340550,6 +328126,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -340557,11 +328138,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -340585,7 +328161,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -340700,11 +328276,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -340775,11 +328347,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -340806,11 +328374,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -340863,7 +328427,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -340879,7 +328447,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -340908,8 +328476,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -340989,8 +328557,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -341007,11 +328575,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -341055,11 +328619,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -341101,11 +328661,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -341123,11 +328679,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -341143,8 +328695,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -341156,13 +328708,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -341196,11 +328748,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -341232,8 +328780,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -341324,11 +328872,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -341351,11 +328895,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -341409,7 +328949,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -341436,7 +328976,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -341452,11 +328992,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -341495,11 +329031,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -341546,8 +329078,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -341568,8 +329100,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -341618,7 +329150,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -341683,13 +329215,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -341717,7 +329249,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -341756,6 +329288,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -341763,11 +329300,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -341791,7 +329323,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -341906,11 +329438,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -341981,11 +329509,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -342012,11 +329536,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -342069,7 +329589,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -342085,7 +329609,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -342114,8 +329638,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -342195,8 +329719,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -342213,11 +329737,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -342261,11 +329781,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -342307,11 +329823,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -342329,11 +329841,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -342349,8 +329857,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -342362,13 +329870,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -342402,11 +329910,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -342438,8 +329942,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -342530,11 +330034,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -342557,11 +330057,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -342615,7 +330111,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -342642,7 +330138,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -342658,11 +330154,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -342701,11 +330193,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -342752,8 +330240,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -342774,8 +330262,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -342824,7 +330312,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -342889,13 +330377,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -342923,7 +330411,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -342962,6 +330450,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -342969,11 +330462,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -342997,7 +330485,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -343112,11 +330600,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -343187,11 +330671,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -343218,11 +330698,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -343275,7 +330751,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -343291,7 +330771,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -343320,8 +330800,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -343401,8 +330881,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -343419,11 +330899,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -343467,11 +330943,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -343513,11 +330985,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -343535,11 +331003,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -343555,8 +331019,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -343568,13 +331032,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -343608,11 +331072,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -343644,8 +331104,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -343736,11 +331196,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -343763,11 +331219,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -343821,7 +331273,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -343848,7 +331300,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -343864,11 +331316,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -343907,11 +331355,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -343958,8 +331402,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -343980,8 +331424,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -344030,7 +331474,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -344095,13 +331539,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -344129,7 +331573,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -344168,6 +331612,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -344175,11 +331624,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -344203,7 +331647,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -344318,11 +331762,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -344393,11 +331833,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -344424,11 +331860,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -344481,7 +331913,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -344497,7 +331933,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -344526,8 +331962,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -344607,8 +332043,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -344625,11 +332061,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -344673,11 +332105,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -344719,11 +332147,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -344741,11 +332165,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -344761,8 +332181,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -344774,13 +332194,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -344814,11 +332234,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -344850,8 +332266,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -344942,11 +332358,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -344969,11 +332381,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -345027,7 +332435,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -345054,7 +332462,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -345070,11 +332478,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -345113,11 +332517,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -345164,8 +332564,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -345186,8 +332586,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -345236,7 +332636,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -345301,13 +332701,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -345335,7 +332735,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -345374,6 +332774,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -345381,11 +332786,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -345409,7 +332809,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -345524,11 +332924,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -345599,11 +332995,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -345630,11 +333022,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -345687,7 +333075,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -345703,7 +333095,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -345732,8 +333124,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -345813,8 +333205,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -345831,11 +333223,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -345879,11 +333267,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -345925,11 +333309,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -345947,11 +333327,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -345967,8 +333343,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -345980,13 +333356,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -346020,11 +333396,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -346056,8 +333428,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -346148,11 +333520,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -346175,11 +333543,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -346233,7 +333597,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -346260,7 +333624,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -346276,11 +333640,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -346319,11 +333679,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -346370,8 +333726,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -346392,8 +333748,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -346442,7 +333798,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -346507,13 +333863,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -346541,7 +333897,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -346580,6 +333936,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -346587,11 +333948,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -346615,7 +333971,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -346730,11 +334086,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -346805,11 +334157,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -346836,11 +334184,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -346893,7 +334237,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -346909,7 +334257,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -346938,8 +334286,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -347019,8 +334367,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -347037,11 +334385,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -347085,11 +334429,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -347131,11 +334471,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -347153,11 +334489,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -347173,8 +334505,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -347186,13 +334518,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -347226,11 +334558,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -347262,8 +334590,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -347354,11 +334682,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -347381,11 +334705,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -347439,7 +334759,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -347466,7 +334786,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -347482,11 +334802,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -347525,11 +334841,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -347576,8 +334888,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -347598,8 +334910,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -347648,7 +334960,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -347713,13 +335025,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -347747,7 +335059,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -347786,6 +335098,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -347793,11 +335110,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -347821,7 +335133,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -347936,11 +335248,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -348011,11 +335319,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -348042,11 +335346,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -348099,7 +335399,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -348115,7 +335419,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -348144,8 +335448,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -348225,8 +335529,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -348243,11 +335547,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -348291,11 +335591,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -348337,11 +335633,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -348359,11 +335651,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -348379,8 +335667,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -348392,13 +335680,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -348432,11 +335720,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -348468,8 +335752,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -348560,11 +335844,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -348587,11 +335867,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -348645,7 +335921,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -348672,7 +335948,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -348688,11 +335964,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -348731,11 +336003,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -348782,8 +336050,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -348804,8 +336072,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -348854,7 +336122,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -348919,13 +336187,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -348953,7 +336221,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -348992,6 +336260,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -348999,11 +336272,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -349027,7 +336295,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -349142,11 +336410,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -349217,11 +336481,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -349248,11 +336508,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -349305,7 +336561,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -349321,7 +336581,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -349350,8 +336610,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -349431,8 +336691,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -349449,11 +336709,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -349497,11 +336753,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -349543,11 +336795,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -349565,11 +336813,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -349585,8 +336829,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -349598,13 +336842,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -349638,11 +336882,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -349674,8 +336914,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -349766,11 +337006,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -349793,11 +337029,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -349851,7 +337083,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -349878,7 +337110,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -349894,11 +337126,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -349937,11 +337165,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -349988,8 +337212,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -350010,8 +337234,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -350060,7 +337284,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -350125,13 +337349,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -350159,7 +337383,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -350198,6 +337422,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -350205,11 +337434,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -350233,7 +337457,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -350348,11 +337572,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -350423,11 +337643,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -350454,11 +337670,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -350511,7 +337723,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -350527,7 +337743,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -350556,8 +337772,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -350637,8 +337853,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -350655,11 +337871,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -350703,11 +337915,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -350749,11 +337957,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -350771,11 +337975,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -350791,8 +337991,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -350804,13 +338004,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -350844,11 +338044,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -350880,8 +338076,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -350972,11 +338168,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -350999,11 +338191,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -351057,7 +338245,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -351084,7 +338272,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -351100,11 +338288,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -351143,11 +338327,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -351194,8 +338374,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -351216,8 +338396,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -351266,7 +338446,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -351331,13 +338511,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -351365,7 +338545,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -351404,6 +338584,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -351411,11 +338596,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -351439,7 +338619,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -351554,11 +338734,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -351629,11 +338805,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -351660,11 +338832,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -351717,7 +338885,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -351733,7 +338905,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -351762,8 +338934,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -351843,8 +339015,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -351861,11 +339033,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -351909,11 +339077,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -351955,11 +339119,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -351977,11 +339137,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -351997,8 +339153,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -352010,13 +339166,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -352050,11 +339206,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -352086,8 +339238,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -352178,11 +339330,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -352205,11 +339353,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -352263,7 +339407,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -352290,7 +339434,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -352306,11 +339450,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -352349,11 +339489,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -352400,8 +339536,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -352422,8 +339558,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -352472,7 +339608,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -352537,13 +339673,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -352571,7 +339707,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -352610,6 +339746,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -352617,11 +339758,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -352645,7 +339781,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -352760,11 +339896,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -352835,11 +339967,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -352866,11 +339994,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -352923,7 +340047,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -352939,7 +340067,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -352968,8 +340096,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -353049,8 +340177,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -353067,11 +340195,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -353115,11 +340239,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -353161,11 +340281,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -353183,11 +340299,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -353203,8 +340315,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -353216,13 +340328,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -353256,11 +340368,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -353292,8 +340400,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -353384,11 +340492,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -353411,11 +340515,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -353469,7 +340569,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -353496,7 +340596,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -353512,11 +340612,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -353555,11 +340651,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -353606,8 +340698,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -353628,8 +340720,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -353678,7 +340770,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -353743,13 +340835,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -353777,7 +340869,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -353816,6 +340908,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -353823,11 +340920,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -353851,7 +340943,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -353966,11 +341058,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -354041,11 +341129,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -354072,11 +341156,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -354129,7 +341209,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -354145,7 +341229,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -354174,8 +341258,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -354255,8 +341339,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -354273,11 +341357,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -354321,11 +341401,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -354367,11 +341443,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -354389,11 +341461,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -354409,8 +341477,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -354422,13 +341490,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -354462,11 +341530,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -354498,8 +341562,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -354590,11 +341654,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -354617,11 +341677,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -354675,7 +341731,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -354702,7 +341758,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -354718,11 +341774,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -354761,11 +341813,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -354812,8 +341860,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -354834,8 +341882,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -354884,7 +341932,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -354949,13 +341997,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -354983,7 +342031,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -355022,6 +342070,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -355029,11 +342082,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -355057,7 +342105,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -355172,11 +342220,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -355247,11 +342291,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -355278,11 +342318,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -355335,7 +342371,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -355351,7 +342391,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -355380,8 +342420,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -355461,8 +342501,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -355479,11 +342519,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -355527,11 +342563,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -355573,11 +342605,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -355595,11 +342623,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -355615,8 +342639,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -355628,13 +342652,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -355668,11 +342692,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -355704,8 +342724,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -355796,11 +342816,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -355823,11 +342839,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -355881,7 +342893,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -355908,7 +342920,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -355924,11 +342936,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -355967,11 +342975,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -356018,8 +343022,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -356040,8 +343044,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -356090,7 +343094,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -356155,13 +343159,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -356189,7 +343193,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -356228,6 +343232,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -356235,11 +343244,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -356263,7 +343267,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -356378,11 +343382,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -356453,11 +343453,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -356484,11 +343480,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -356541,7 +343533,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -356557,7 +343553,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -356586,8 +343582,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -356667,8 +343663,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -356685,11 +343681,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -356733,11 +343725,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -356779,11 +343767,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -356801,11 +343785,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -356821,8 +343801,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -356834,13 +343814,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -356874,11 +343854,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -356910,8 +343886,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -357002,11 +343978,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -357029,11 +344001,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -357087,7 +344055,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -357114,7 +344082,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -357130,11 +344098,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -357173,11 +344137,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -357224,8 +344184,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -357246,8 +344206,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -357296,7 +344256,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -357361,13 +344321,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -357395,7 +344355,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -357434,6 +344394,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -357441,11 +344406,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -357469,7 +344429,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -357584,11 +344544,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -357659,11 +344615,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -357690,11 +344642,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -357747,7 +344695,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -357763,7 +344715,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -357792,8 +344744,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -357873,8 +344825,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -357891,11 +344843,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -357939,11 +344887,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -357985,11 +344929,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -358007,11 +344947,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -358027,8 +344963,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -358040,13 +344976,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -358080,11 +345016,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -358116,8 +345048,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -358208,11 +345140,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -358235,11 +345163,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -358293,7 +345217,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -358320,7 +345244,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -358336,11 +345260,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -358379,11 +345299,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -358430,8 +345346,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -358452,8 +345368,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -358502,7 +345418,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -358567,13 +345483,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -358601,7 +345517,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -358640,6 +345556,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -358647,11 +345568,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -358675,7 +345591,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -358790,11 +345706,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -358865,11 +345777,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -358896,11 +345804,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -358953,7 +345857,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -358969,7 +345877,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -358998,8 +345906,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -359079,8 +345987,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -359097,11 +346005,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -359145,11 +346049,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -359191,11 +346091,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -359213,11 +346109,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -359233,8 +346125,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -359246,13 +346138,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -359286,11 +346178,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -359322,8 +346210,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -359414,11 +346302,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -359441,11 +346325,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -359499,7 +346379,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -359526,7 +346406,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -359542,11 +346422,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -359585,11 +346461,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -359636,8 +346508,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -359658,8 +346530,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -359708,7 +346580,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -359773,13 +346645,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -359807,7 +346679,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -359846,6 +346718,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -359853,11 +346730,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -359881,7 +346753,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -359996,11 +346868,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -360071,11 +346939,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -360102,11 +346966,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -360159,7 +347019,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -360175,7 +347039,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -360204,8 +347068,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -360285,8 +347149,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -360303,11 +347167,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -360351,11 +347211,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -360397,11 +347253,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -360419,11 +347271,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -360439,8 +347287,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -360452,13 +347300,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -360492,11 +347340,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -360528,8 +347372,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -360620,11 +347464,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -360647,11 +347487,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -360705,7 +347541,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -360732,7 +347568,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -360748,11 +347584,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -360791,11 +347623,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -360842,8 +347670,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -360864,8 +347692,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -360914,7 +347742,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -360979,13 +347807,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -361013,7 +347841,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -361052,6 +347880,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -361059,11 +347892,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -361087,7 +347915,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -361202,11 +348030,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -361277,11 +348101,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -361308,11 +348128,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -361365,7 +348181,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -361381,7 +348201,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -361410,8 +348230,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -361491,8 +348311,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -361509,11 +348329,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -361557,11 +348373,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -361603,11 +348415,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -361625,11 +348433,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -361645,8 +348449,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -361658,13 +348462,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -361698,11 +348502,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -361734,8 +348534,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -361826,11 +348626,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -361853,11 +348649,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -361911,7 +348703,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -361938,7 +348730,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -361954,11 +348746,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -361997,11 +348785,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -362048,8 +348832,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -362070,8 +348854,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -362120,7 +348904,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -362185,13 +348969,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -362219,7 +349003,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -362258,6 +349042,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -362265,11 +349054,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -362293,7 +349077,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -362408,11 +349192,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -362483,11 +349263,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -362514,11 +349290,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -362571,7 +349343,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -362587,7 +349363,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -362616,8 +349392,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -362697,8 +349473,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -362715,11 +349491,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -362763,11 +349535,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -362809,11 +349577,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -362831,11 +349595,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -362851,8 +349611,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -362864,13 +349624,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -362904,11 +349664,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -362940,8 +349696,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -363032,11 +349788,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -363059,11 +349811,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -363117,7 +349865,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -363144,7 +349892,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -363160,11 +349908,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -363203,11 +349947,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -363254,8 +349994,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -363276,8 +350016,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -363326,7 +350066,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -363391,13 +350131,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -363425,7 +350165,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -363464,6 +350204,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -363471,11 +350216,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -363499,7 +350239,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -363614,11 +350354,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -363689,11 +350425,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -363720,11 +350452,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -363777,7 +350505,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -363793,7 +350525,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -363822,8 +350554,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -363903,8 +350635,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -363921,11 +350653,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -363969,11 +350697,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -364015,11 +350739,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -364037,11 +350757,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -364057,8 +350773,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -364070,13 +350786,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -364110,11 +350826,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -364146,8 +350858,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -364238,11 +350950,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -364265,11 +350973,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -364323,7 +351027,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -364350,7 +351054,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -364366,11 +351070,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -364409,11 +351109,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -364460,8 +351156,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -364482,8 +351178,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -364532,7 +351228,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -364597,13 +351293,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -364631,7 +351327,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -364670,6 +351366,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -364677,11 +351378,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -364705,7 +351401,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -364820,11 +351516,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -364895,11 +351587,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -364926,11 +351614,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -364983,7 +351667,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -364999,7 +351687,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -365028,8 +351716,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -365109,8 +351797,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -365127,11 +351815,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -365175,11 +351859,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -365221,11 +351901,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -365243,11 +351919,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -365263,8 +351935,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -365276,13 +351948,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -365316,11 +351988,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -365352,8 +352020,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -365444,11 +352112,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -365471,11 +352135,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -365529,7 +352189,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -365556,7 +352216,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -365572,11 +352232,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -365615,11 +352271,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -365666,8 +352318,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -365688,8 +352340,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -365738,7 +352390,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -365803,13 +352455,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -365837,7 +352489,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -365876,6 +352528,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -365883,11 +352540,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -365911,7 +352563,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -366026,11 +352678,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -366101,11 +352749,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -366132,11 +352776,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -366189,7 +352829,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -366205,7 +352849,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -366234,8 +352878,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -366315,8 +352959,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -366333,11 +352977,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -366381,11 +353021,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -366427,11 +353063,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -366449,11 +353081,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -366469,8 +353097,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -366482,13 +353110,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -366522,11 +353150,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -366558,8 +353182,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -366650,11 +353274,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -366677,11 +353297,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -366735,7 +353351,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -366762,7 +353378,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -366778,11 +353394,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -366821,11 +353433,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -366872,8 +353480,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -366894,8 +353502,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -366944,7 +353552,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -367009,13 +353617,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -367043,7 +353651,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -367082,6 +353690,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -367089,11 +353702,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -367117,7 +353725,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -367232,11 +353840,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -367307,11 +353911,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -367338,11 +353938,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -367395,7 +353991,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -367411,7 +354011,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -367440,8 +354040,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -367521,8 +354121,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -367539,11 +354139,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -367587,11 +354183,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -367633,11 +354225,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -367655,11 +354243,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -367675,8 +354259,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -367688,13 +354272,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -367728,11 +354312,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -367764,8 +354344,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -367856,11 +354436,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -367883,11 +354459,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -367941,7 +354513,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -367968,7 +354540,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -367984,11 +354556,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -368027,11 +354595,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -368078,8 +354642,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -368100,8 +354664,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -368150,7 +354714,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -368215,13 +354779,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -368249,7 +354813,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -368288,6 +354852,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -368295,11 +354864,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -368323,7 +354887,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -368438,11 +355002,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -368513,11 +355073,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -368544,11 +355100,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -368601,7 +355153,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -368617,7 +355173,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -368646,8 +355202,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -368727,8 +355283,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -368745,11 +355301,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -368793,11 +355345,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -368839,11 +355387,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -368861,11 +355405,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -368881,8 +355421,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -368894,13 +355434,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -368934,11 +355474,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -368970,8 +355506,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -369062,11 +355598,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -369089,11 +355621,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -369147,7 +355675,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -369174,7 +355702,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -369190,11 +355718,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -369233,11 +355757,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -369284,8 +355804,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -369306,8 +355826,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -369356,7 +355876,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -369421,13 +355941,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -369455,7 +355975,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -369494,6 +356014,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -369501,11 +356026,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -369529,7 +356049,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -369644,11 +356164,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -369719,11 +356235,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -369750,11 +356262,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -369807,7 +356315,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -369823,7 +356335,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -369852,8 +356364,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -369933,8 +356445,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -369951,11 +356463,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -369999,11 +356507,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -370045,11 +356549,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -370067,11 +356567,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -370087,8 +356583,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -370100,13 +356596,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -370140,11 +356636,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -370176,8 +356668,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -370268,11 +356760,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -370295,11 +356783,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -370353,7 +356837,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -370380,7 +356864,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -370396,11 +356880,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -370439,11 +356919,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -370490,8 +356966,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -370512,8 +356988,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -370562,7 +357038,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -370627,13 +357103,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -370661,7 +357137,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -370700,6 +357176,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -370707,11 +357188,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -370735,7 +357211,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -370850,11 +357326,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -370925,11 +357397,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -370956,11 +357424,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -371013,7 +357477,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -371029,7 +357497,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -371058,8 +357526,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -371139,8 +357607,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -371157,11 +357625,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -371205,11 +357669,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -371251,11 +357711,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -371273,11 +357729,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -371293,8 +357745,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -371306,13 +357758,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -371346,11 +357798,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -371382,8 +357830,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -371474,11 +357922,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -371501,11 +357945,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -371559,7 +357999,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -371586,7 +358026,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -371602,11 +358042,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -371645,11 +358081,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -371696,8 +358128,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -371718,8 +358150,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -371768,7 +358200,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -371833,13 +358265,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -371867,7 +358299,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -371906,6 +358338,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -371913,11 +358350,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -371941,7 +358373,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -372056,11 +358488,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -372131,11 +358559,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -372162,11 +358586,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -372219,7 +358639,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -372235,7 +358659,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -372264,8 +358688,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -372345,8 +358769,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -372363,11 +358787,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -372411,11 +358831,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -372457,11 +358873,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -372479,11 +358891,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -372499,8 +358907,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -372512,13 +358920,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -372552,11 +358960,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -372588,8 +358992,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -372680,11 +359084,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -372707,11 +359107,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -372765,7 +359161,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -372792,7 +359188,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -372808,11 +359204,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -372851,11 +359243,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -372902,8 +359290,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -372924,8 +359312,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -372974,7 +359362,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -373039,13 +359427,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -373073,7 +359461,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -373112,6 +359500,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -373119,11 +359512,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -373147,7 +359535,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -373262,11 +359650,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -373337,11 +359721,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -373368,11 +359748,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -373425,7 +359801,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -373441,7 +359821,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -373470,8 +359850,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -373551,8 +359931,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -373569,11 +359949,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -373617,11 +359993,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -373663,11 +360035,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -373685,11 +360053,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -373705,8 +360069,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -373718,13 +360082,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -373758,11 +360122,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -373794,8 +360154,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -373886,11 +360246,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -373913,11 +360269,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -373971,7 +360323,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -373998,7 +360350,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -374014,11 +360366,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -374057,11 +360405,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -374108,8 +360452,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -374130,8 +360474,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -374180,7 +360524,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -374245,13 +360589,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -374279,7 +360623,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -374318,6 +360662,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -374325,11 +360674,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -374353,7 +360697,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -374468,11 +360812,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -374543,11 +360883,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -374574,11 +360910,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -374631,7 +360963,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -374647,7 +360983,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -374676,8 +361012,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -374757,8 +361093,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -374775,11 +361111,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -374823,11 +361155,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -374869,11 +361197,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -374891,11 +361215,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -374911,8 +361231,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -374924,13 +361244,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -374964,11 +361284,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -375000,8 +361316,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -375092,11 +361408,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -375119,11 +361431,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -375177,7 +361485,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -375204,7 +361512,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -375220,11 +361528,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -375263,11 +361567,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -375314,8 +361614,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -375336,8 +361636,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -375386,7 +361686,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -375451,13 +361751,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -375485,7 +361785,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -375524,6 +361824,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -375531,11 +361836,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -375559,7 +361859,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -375674,11 +361974,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -375749,11 +362045,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -375780,11 +362072,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -375837,7 +362125,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -375853,7 +362145,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -375882,8 +362174,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -375963,8 +362255,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -375981,11 +362273,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -376029,11 +362317,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -376075,11 +362359,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -376097,11 +362377,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -376117,8 +362393,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -376130,13 +362406,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -376170,11 +362446,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -376206,8 +362478,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -376298,11 +362570,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -376325,11 +362593,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -376383,7 +362647,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -376410,7 +362674,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -376426,11 +362690,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -376469,11 +362729,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -376520,8 +362776,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -376542,8 +362798,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -376592,7 +362848,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -376657,13 +362913,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -376691,7 +362947,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -376730,6 +362986,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -376737,11 +362998,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -376765,7 +363021,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -376880,11 +363136,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -376955,11 +363207,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -376986,11 +363234,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -377043,7 +363287,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -377059,7 +363307,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -377088,8 +363336,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -377169,8 +363417,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -377187,11 +363435,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -377235,11 +363479,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -377281,11 +363521,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -377303,11 +363539,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -377323,8 +363555,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -377336,13 +363568,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -377376,11 +363608,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -377412,8 +363640,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -377504,11 +363732,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -377531,11 +363755,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -377589,7 +363809,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -377616,7 +363836,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -377632,11 +363852,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -377675,11 +363891,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -377726,8 +363938,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -377748,8 +363960,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -377798,7 +364010,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -377863,13 +364075,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -377897,7 +364109,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -377936,6 +364148,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -377943,11 +364160,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -377971,7 +364183,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -378086,11 +364298,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -378161,11 +364369,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -378192,11 +364396,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -378249,7 +364449,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -378265,7 +364469,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -378294,8 +364498,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -378375,8 +364579,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -378393,11 +364597,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -378441,11 +364641,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -378487,11 +364683,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -378509,11 +364701,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -378529,8 +364717,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -378542,13 +364730,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -378582,11 +364770,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -378618,8 +364802,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -378710,11 +364894,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -378737,11 +364917,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -378795,7 +364971,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -378822,7 +364998,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -378838,11 +365014,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -378881,11 +365053,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -378932,8 +365100,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -378954,8 +365122,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -379004,7 +365172,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -379069,13 +365237,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -379103,7 +365271,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -379142,6 +365310,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -379149,11 +365322,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -379177,7 +365345,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -379292,11 +365460,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -379367,11 +365531,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -379398,11 +365558,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -379455,7 +365611,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -379471,7 +365631,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -379500,8 +365660,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -379581,8 +365741,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -379599,11 +365759,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -379647,11 +365803,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -379693,11 +365845,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -379715,11 +365863,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -379735,8 +365879,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -379748,13 +365892,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -379788,11 +365932,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -379824,8 +365964,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -379916,11 +366056,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -379943,11 +366079,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -380001,7 +366133,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -380028,7 +366160,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -380044,11 +366176,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -380087,11 +366215,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -380138,8 +366262,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -380160,8 +366284,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -380210,7 +366334,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -380275,13 +366399,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -380309,7 +366433,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -380348,6 +366472,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -380355,11 +366484,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -380383,7 +366507,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -380498,11 +366622,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -380573,11 +366693,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -380604,11 +366720,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -380661,7 +366773,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -380677,7 +366793,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -380706,8 +366822,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -380787,8 +366903,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -380805,11 +366921,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -380853,11 +366965,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -380899,11 +367007,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -380921,11 +367025,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -380941,8 +367041,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -380954,13 +367054,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -380994,11 +367094,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -381030,8 +367126,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -381122,11 +367218,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -381149,11 +367241,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -381207,7 +367295,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -381234,7 +367322,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -381250,11 +367338,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -381293,11 +367377,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -381344,8 +367424,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -381366,8 +367446,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -381416,7 +367496,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -381481,13 +367561,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -381515,7 +367595,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -381554,6 +367634,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -381561,11 +367646,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -381589,7 +367669,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -381704,11 +367784,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -381779,11 +367855,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -381810,11 +367882,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -381867,7 +367935,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -381883,7 +367955,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -381912,8 +367984,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -381993,8 +368065,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -382011,11 +368083,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -382059,11 +368127,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -382105,11 +368169,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -382127,11 +368187,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -382147,8 +368203,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -382160,13 +368216,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -382200,11 +368256,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -382236,8 +368288,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -382328,11 +368380,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -382355,11 +368403,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -382413,7 +368457,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -382440,7 +368484,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -382456,11 +368500,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -382499,11 +368539,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -382550,8 +368586,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -382572,8 +368608,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -382622,7 +368658,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -382687,13 +368723,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -382721,7 +368757,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -382760,6 +368796,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -382767,11 +368808,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -382795,7 +368831,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -382910,11 +368946,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -382985,11 +369017,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -383016,11 +369044,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -383073,7 +369097,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -383089,7 +369117,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -383118,8 +369146,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -383199,8 +369227,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -383217,11 +369245,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -383265,11 +369289,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -383311,11 +369331,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -383333,11 +369349,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -383353,8 +369365,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -383366,13 +369378,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -383406,11 +369418,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -383442,8 +369450,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -383534,11 +369542,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -383561,11 +369565,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -383619,7 +369619,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -383646,7 +369646,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -383662,11 +369662,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -383705,11 +369701,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -383756,8 +369748,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -383778,8 +369770,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -383828,7 +369820,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -383893,13 +369885,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -383927,7 +369919,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -383966,6 +369958,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -383973,11 +369970,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -384001,7 +369993,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -384116,11 +370108,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -384191,11 +370179,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -384222,11 +370206,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -384279,7 +370259,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -384295,7 +370279,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -384324,8 +370308,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -384405,8 +370389,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -384423,11 +370407,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -384471,11 +370451,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -384517,11 +370493,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -384539,11 +370511,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -384559,8 +370527,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -384572,13 +370540,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -384612,11 +370580,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -384648,8 +370612,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -384740,11 +370704,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -384767,11 +370727,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -384825,7 +370781,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -384852,7 +370808,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -384868,11 +370824,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -384911,11 +370863,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -384962,8 +370910,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -384984,8 +370932,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -385034,7 +370982,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -385099,13 +371047,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -385133,7 +371081,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -385172,6 +371120,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -385179,11 +371132,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -385207,7 +371155,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -385322,11 +371270,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -385397,11 +371341,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -385428,11 +371368,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -385485,7 +371421,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -385501,7 +371441,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -385530,8 +371470,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -385611,8 +371551,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -385629,11 +371569,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -385677,11 +371613,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -385723,11 +371655,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -385745,11 +371673,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -385765,8 +371689,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -385778,13 +371702,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -385818,11 +371742,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -385854,8 +371774,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -385946,11 +371866,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -385973,11 +371889,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -386031,7 +371943,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -386058,7 +371970,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -386074,11 +371986,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -386117,11 +372025,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -386168,8 +372072,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -386190,8 +372094,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -386240,7 +372144,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -386305,13 +372209,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -386339,7 +372243,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -386378,6 +372282,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -386385,11 +372294,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -386413,7 +372317,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -386528,11 +372432,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -386603,11 +372503,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -386634,11 +372530,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -386691,7 +372583,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -386707,7 +372603,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -386736,8 +372632,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -386817,8 +372713,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -386835,11 +372731,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -386883,11 +372775,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -386929,11 +372817,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -386951,11 +372835,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -386971,8 +372851,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -386984,13 +372864,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -387024,11 +372904,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -387060,8 +372936,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -387152,11 +373028,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -387179,11 +373051,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -387237,7 +373105,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -387264,7 +373132,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -387280,11 +373148,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -387323,11 +373187,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -387374,8 +373234,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -387396,8 +373256,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -387446,7 +373306,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -387511,13 +373371,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -387545,7 +373405,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -387584,6 +373444,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -387591,11 +373456,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -387619,7 +373479,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -387734,11 +373594,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -387809,11 +373665,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -387840,11 +373692,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -387897,7 +373745,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -387913,7 +373765,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -387942,8 +373794,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -388023,8 +373875,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -388041,11 +373893,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -388089,11 +373937,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -388135,11 +373979,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -388157,11 +373997,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -388177,8 +374013,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -388190,13 +374026,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -388230,11 +374066,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -388266,8 +374098,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -388358,11 +374190,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -388385,11 +374213,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -388443,7 +374267,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -388470,7 +374294,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -388486,11 +374310,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -388529,11 +374349,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -388580,8 +374396,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -388602,8 +374418,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -388652,7 +374468,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -388717,13 +374533,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -388751,7 +374567,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -388790,6 +374606,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -388797,11 +374618,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -388825,7 +374641,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -388940,11 +374756,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -389015,11 +374827,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -389046,11 +374854,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -389103,7 +374907,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -389119,7 +374927,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -389148,8 +374956,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -389229,8 +375037,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -389247,11 +375055,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -389295,11 +375099,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -389341,11 +375141,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -389363,11 +375159,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -389383,8 +375175,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -389396,13 +375188,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -389436,11 +375228,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -389472,8 +375260,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -389564,11 +375352,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -389591,11 +375375,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -389649,7 +375429,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -389676,7 +375456,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -389692,11 +375472,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -389735,11 +375511,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -389786,8 +375558,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -389808,8 +375580,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -389858,7 +375630,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -389923,13 +375695,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -389957,7 +375729,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -389996,6 +375768,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -390003,11 +375780,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -390031,7 +375803,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -390146,11 +375918,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -390221,11 +375989,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -390252,11 +376016,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -390309,7 +376069,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -390325,7 +376089,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -390354,8 +376118,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -390435,8 +376199,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -390453,11 +376217,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -390501,11 +376261,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -390547,11 +376303,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -390569,11 +376321,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -390589,8 +376337,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -390602,13 +376350,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -390642,11 +376390,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -390678,8 +376422,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -390770,11 +376514,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -390797,11 +376537,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -390855,7 +376591,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -390882,7 +376618,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -390898,11 +376634,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -390941,11 +376673,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -390992,8 +376720,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -391014,8 +376742,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -391064,7 +376792,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -391129,13 +376857,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -391163,7 +376891,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -391202,6 +376930,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -391209,11 +376942,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -391237,7 +376965,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -391352,11 +377080,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -391427,11 +377151,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -391458,11 +377178,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -391515,7 +377231,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -391531,7 +377251,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -391560,8 +377280,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -391641,8 +377361,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -391659,11 +377379,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -391707,11 +377423,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -391753,11 +377465,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -391775,11 +377483,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -391795,8 +377499,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -391808,13 +377512,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -391848,11 +377552,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -391884,8 +377584,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -391976,11 +377676,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -392003,11 +377699,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -392061,7 +377753,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -392088,7 +377780,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -392104,11 +377796,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -392147,11 +377835,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -392198,8 +377882,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -392220,8 +377904,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -392270,7 +377954,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -392335,13 +378019,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -392369,7 +378053,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -392408,6 +378092,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -392415,11 +378104,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -392443,7 +378127,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -392558,11 +378242,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -392633,11 +378313,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -392664,11 +378340,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -392721,7 +378393,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -392737,7 +378413,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -392766,8 +378442,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -392847,8 +378523,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -392865,11 +378541,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -392913,11 +378585,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -392959,11 +378627,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -392981,11 +378645,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -393001,8 +378661,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -393014,13 +378674,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -393054,11 +378714,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -393090,8 +378746,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -393182,11 +378838,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -393209,11 +378861,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -393267,7 +378915,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -393294,7 +378942,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -393310,11 +378958,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -393353,11 +378997,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -393404,8 +379044,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -393426,8 +379066,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -393476,7 +379116,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -393541,13 +379181,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -393575,7 +379215,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -393614,6 +379254,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -393621,11 +379266,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -393649,7 +379289,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -393764,11 +379404,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -393839,11 +379475,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -393870,11 +379502,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -393927,7 +379555,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -393943,7 +379575,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -393972,8 +379604,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -394053,8 +379685,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -394071,11 +379703,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -394119,11 +379747,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -394165,11 +379789,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -394187,11 +379807,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -394207,8 +379823,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -394220,13 +379836,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -394260,11 +379876,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -394296,8 +379908,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -394388,11 +380000,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -394415,11 +380023,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -394473,7 +380077,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -394500,7 +380104,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -394516,11 +380120,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -394559,11 +380159,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -394610,8 +380206,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -394632,8 +380228,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -394682,7 +380278,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -394747,13 +380343,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -394781,7 +380377,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -394820,6 +380416,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -394827,11 +380428,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -394855,7 +380451,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -394970,11 +380566,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -395045,11 +380637,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -395076,11 +380664,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -395133,7 +380717,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -395149,7 +380737,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -395178,8 +380766,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -395259,8 +380847,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -395277,11 +380865,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -395325,11 +380909,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -395371,11 +380951,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -395393,11 +380969,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -395413,8 +380985,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -395426,13 +380998,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -395466,11 +381038,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -395502,8 +381070,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -395594,11 +381162,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -395621,11 +381185,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -395679,7 +381239,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -395706,7 +381266,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -395722,11 +381282,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -395765,11 +381321,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -395816,8 +381368,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -395838,8 +381390,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -395888,7 +381440,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -395953,13 +381505,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -395987,7 +381539,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -396026,6 +381578,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -396033,11 +381590,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -396061,7 +381613,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -396176,11 +381728,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -396251,11 +381799,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -396282,11 +381826,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -396339,7 +381879,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -396355,7 +381899,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -396384,8 +381928,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -396465,8 +382009,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -396483,11 +382027,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -396531,11 +382071,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -396577,11 +382113,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -396599,11 +382131,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -396619,8 +382147,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -396632,13 +382160,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -396672,11 +382200,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -396708,8 +382232,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -396800,11 +382324,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -396827,11 +382347,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -396885,7 +382401,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -396912,7 +382428,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -396928,11 +382444,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -396971,11 +382483,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -397022,8 +382530,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -397044,8 +382552,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -397094,7 +382602,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -397159,13 +382667,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -397193,7 +382701,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -397232,6 +382740,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -397239,11 +382752,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -397267,7 +382775,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -397382,11 +382890,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -397457,11 +382961,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -397488,11 +382988,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -397545,7 +383041,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -397561,7 +383061,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -397590,8 +383090,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -397671,8 +383171,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -397689,11 +383189,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -397737,11 +383233,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -397783,11 +383275,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -397805,11 +383293,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -397825,8 +383309,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -397838,13 +383322,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -397878,11 +383362,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -397914,8 +383394,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -398006,11 +383486,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -398033,11 +383509,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -398091,7 +383563,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -398118,7 +383590,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -398134,11 +383606,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -398177,11 +383645,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -398228,8 +383692,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -398250,8 +383714,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -398300,7 +383764,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -398365,13 +383829,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -398399,7 +383863,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -398438,6 +383902,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -398445,11 +383914,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -398473,7 +383937,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -398588,11 +384052,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -398663,11 +384123,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -398694,11 +384150,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -398751,7 +384203,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -398767,7 +384223,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -398796,8 +384252,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -398877,8 +384333,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -398895,11 +384351,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -398943,11 +384395,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -398989,11 +384437,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -399011,11 +384455,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -399031,8 +384471,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -399044,13 +384484,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -399084,11 +384524,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -399120,8 +384556,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -399212,11 +384648,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -399239,11 +384671,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -399297,7 +384725,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -399324,7 +384752,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -399340,11 +384768,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -399383,11 +384807,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -399434,8 +384854,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -399456,8 +384876,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -399506,7 +384926,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -399571,13 +384991,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -399605,7 +385025,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -399644,6 +385064,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -399651,11 +385076,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -399679,7 +385099,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -399794,11 +385214,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -399869,11 +385285,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -399900,11 +385312,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -399957,7 +385365,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -399973,7 +385385,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -400002,8 +385414,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -400083,8 +385495,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -400101,11 +385513,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -400149,11 +385557,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -400195,11 +385599,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -400217,11 +385617,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -400237,8 +385633,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -400250,13 +385646,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -400290,11 +385686,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -400326,8 +385718,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -400418,11 +385810,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -400445,11 +385833,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -400503,7 +385887,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -400530,7 +385914,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -400546,11 +385930,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -400589,11 +385969,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -400640,8 +386016,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -400662,8 +386038,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -400712,7 +386088,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -400777,13 +386153,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -400811,7 +386187,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -400850,6 +386226,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -400857,11 +386238,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -400885,7 +386261,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -401000,11 +386376,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -401075,11 +386447,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -401106,11 +386474,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -401163,7 +386527,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -401179,7 +386547,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -401208,8 +386576,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -401289,8 +386657,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -401307,11 +386675,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -401355,11 +386719,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -401401,11 +386761,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -401423,11 +386779,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -401443,8 +386795,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -401456,13 +386808,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -401496,11 +386848,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -401532,8 +386880,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -401624,11 +386972,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -401651,11 +386995,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -401709,7 +387049,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -401736,7 +387076,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -401752,11 +387092,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -401795,11 +387131,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -401846,8 +387178,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -401868,8 +387200,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -401918,7 +387250,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -401983,13 +387315,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -402017,7 +387349,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -402056,6 +387388,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -402063,11 +387400,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -402091,7 +387423,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -402206,11 +387538,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -402281,11 +387609,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -402312,11 +387636,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -402369,7 +387689,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -402385,7 +387709,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -402414,8 +387738,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -402495,8 +387819,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -402513,11 +387837,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -402561,11 +387881,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -402607,11 +387923,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -402629,11 +387941,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -402649,8 +387957,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -402662,13 +387970,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -402702,11 +388010,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -402738,8 +388042,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -402830,11 +388134,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -402857,11 +388157,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -402915,7 +388211,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -402942,7 +388238,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -402958,11 +388254,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -403001,11 +388293,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -403052,8 +388340,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -403074,8 +388362,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -403124,7 +388412,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -403189,13 +388477,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -403223,7 +388511,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -403262,6 +388550,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -403269,11 +388562,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -403297,7 +388585,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -403412,11 +388700,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -403487,11 +388771,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -403518,11 +388798,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -403575,7 +388851,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -403591,7 +388871,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -403620,8 +388900,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -403701,8 +388981,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -403719,11 +388999,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -403767,11 +389043,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -403813,11 +389085,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -403835,11 +389103,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -403855,8 +389119,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -403868,13 +389132,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -403908,11 +389172,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -403944,8 +389204,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -404036,11 +389296,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -404063,11 +389319,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -404121,7 +389373,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -404148,7 +389400,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -404164,11 +389416,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -404207,11 +389455,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -404258,8 +389502,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -404280,8 +389524,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -404330,7 +389574,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -404395,13 +389639,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -404429,7 +389673,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -404468,6 +389712,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -404475,11 +389724,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -404503,7 +389747,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -404618,11 +389862,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -404693,11 +389933,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -404724,11 +389960,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -404781,7 +390013,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -404797,7 +390033,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -404826,8 +390062,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -404907,8 +390143,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -404925,11 +390161,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -404973,11 +390205,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -405019,11 +390247,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -405041,11 +390265,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -405061,8 +390281,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -405074,13 +390294,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -405114,11 +390334,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -405150,8 +390366,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -405242,11 +390458,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -405269,11 +390481,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -405327,7 +390535,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -405354,7 +390562,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -405370,11 +390578,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -405413,11 +390617,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -405464,8 +390664,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -405486,8 +390686,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -405536,7 +390736,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -405601,13 +390801,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -405635,7 +390835,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -405674,6 +390874,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -405681,11 +390886,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -405709,7 +390909,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -405824,11 +391024,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -405899,11 +391095,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -405930,11 +391122,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -405987,7 +391175,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -406003,7 +391195,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -406032,8 +391224,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -406113,8 +391305,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -406131,11 +391323,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -406179,11 +391367,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -406225,11 +391409,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -406247,11 +391427,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -406267,8 +391443,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -406280,13 +391456,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -406320,11 +391496,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -406356,8 +391528,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -406448,11 +391620,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -406475,11 +391643,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -406533,7 +391697,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -406560,7 +391724,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -406576,11 +391740,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -406619,11 +391779,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -406670,8 +391826,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -406692,8 +391848,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -406742,7 +391898,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -406807,13 +391963,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -406841,7 +391997,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -406880,6 +392036,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -406887,11 +392048,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -406915,7 +392071,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -407030,11 +392186,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -407105,11 +392257,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -407136,11 +392284,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -407193,7 +392337,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -407209,7 +392357,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -407238,8 +392386,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -407319,8 +392467,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -407337,11 +392485,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -407385,11 +392529,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -407431,11 +392571,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -407453,11 +392589,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -407473,8 +392605,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -407486,13 +392618,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -407526,11 +392658,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -407562,8 +392690,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -407654,11 +392782,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -407681,11 +392805,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -407739,7 +392859,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -407766,7 +392886,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -407782,11 +392902,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -407825,11 +392941,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -407876,8 +392988,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -407898,8 +393010,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -407948,7 +393060,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -408013,13 +393125,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -408047,7 +393159,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -408086,6 +393198,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -408093,11 +393210,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -408121,7 +393233,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -408236,11 +393348,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -408311,11 +393419,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -408342,11 +393446,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -408399,7 +393499,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -408415,7 +393519,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -408444,8 +393548,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -408525,8 +393629,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -408543,11 +393647,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -408591,11 +393691,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -408637,11 +393733,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -408659,11 +393751,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -408679,8 +393767,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -408692,13 +393780,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -408732,11 +393820,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -408768,8 +393852,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -408860,11 +393944,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -408887,11 +393967,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -408945,7 +394021,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -408972,7 +394048,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -408988,11 +394064,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -409031,11 +394103,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -409082,8 +394150,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -409104,8 +394172,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -409154,7 +394222,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -409219,13 +394287,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -409253,7 +394321,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -409292,6 +394360,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -409299,11 +394372,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -409327,7 +394395,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -409442,11 +394510,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -409517,11 +394581,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -409548,11 +394608,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -409605,7 +394661,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -409621,7 +394681,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -409650,8 +394710,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -409731,8 +394791,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -409749,11 +394809,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -409797,11 +394853,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -409843,11 +394895,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -409865,11 +394913,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -409885,8 +394929,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -409898,13 +394942,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -409938,11 +394982,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -409974,8 +395014,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -410066,11 +395106,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -410093,11 +395129,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -410151,7 +395183,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -410178,7 +395210,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -410194,11 +395226,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -410237,11 +395265,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -410288,8 +395312,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -410310,8 +395334,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -410360,7 +395384,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -410425,13 +395449,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -410459,7 +395483,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -410498,6 +395522,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -410505,11 +395534,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -410533,7 +395557,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -410648,11 +395672,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -410723,11 +395743,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -410754,11 +395770,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -410811,7 +395823,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -410827,7 +395843,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -410856,8 +395872,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -410937,8 +395953,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -410955,11 +395971,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -411003,11 +396015,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -411049,11 +396057,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -411071,11 +396075,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -411091,8 +396091,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -411104,13 +396104,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -411144,11 +396144,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -411180,8 +396176,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -411272,11 +396268,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -411299,11 +396291,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -411357,7 +396345,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -411384,7 +396372,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -411400,11 +396388,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -411443,11 +396427,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -411494,8 +396474,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -411516,8 +396496,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -411566,7 +396546,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -411631,13 +396611,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -411665,7 +396645,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -411704,6 +396684,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -411711,11 +396696,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -411739,7 +396719,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -411854,11 +396834,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -411929,11 +396905,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -411960,11 +396932,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -412017,7 +396985,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -412033,7 +397005,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -412062,8 +397034,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -412143,8 +397115,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -412161,11 +397133,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -412209,11 +397177,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -412255,11 +397219,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -412277,11 +397237,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -412297,8 +397253,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -412310,13 +397266,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -412350,11 +397306,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -412386,8 +397338,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -412478,11 +397430,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -412505,11 +397453,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -412563,7 +397507,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -412590,7 +397534,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -412606,11 +397550,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -412649,11 +397589,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -412700,8 +397636,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -412722,8 +397658,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -412772,7 +397708,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -412837,13 +397773,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -412871,7 +397807,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -412910,6 +397846,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -412917,11 +397858,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -412945,7 +397881,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -413060,11 +397996,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -413135,11 +398067,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -413166,11 +398094,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -413223,7 +398147,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -413239,7 +398167,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -413268,8 +398196,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -413349,8 +398277,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -413367,11 +398295,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -413415,11 +398339,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -413461,11 +398381,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -413483,11 +398399,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -413503,8 +398415,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -413516,13 +398428,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -413556,11 +398468,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -413592,8 +398500,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -413684,11 +398592,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -413711,11 +398615,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -413769,7 +398669,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -413796,7 +398696,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -413812,11 +398712,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -413855,11 +398751,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -413906,8 +398798,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -413928,8 +398820,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -413978,7 +398870,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -414043,13 +398935,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -414077,7 +398969,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -414116,6 +399008,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -414123,11 +399020,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -414151,7 +399043,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -414266,11 +399158,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -414341,11 +399229,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -414372,11 +399256,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -414429,7 +399309,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -414445,7 +399329,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -414474,8 +399358,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -414555,8 +399439,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -414573,11 +399457,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -414621,11 +399501,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -414667,11 +399543,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -414689,11 +399561,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -414709,8 +399577,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -414722,13 +399590,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -414762,11 +399630,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -414798,8 +399662,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -414890,11 +399754,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -414917,11 +399777,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -414975,7 +399831,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -415002,7 +399858,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -415018,11 +399874,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -415061,11 +399913,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -415112,8 +399960,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -415134,8 +399982,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -415184,7 +400032,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -415249,13 +400097,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -415283,7 +400131,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -415322,6 +400170,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -415329,11 +400182,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -415357,7 +400205,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -415472,11 +400320,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -415547,11 +400391,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -415578,11 +400418,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -415635,7 +400471,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -415651,7 +400491,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -415680,8 +400520,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -415761,8 +400601,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -415779,11 +400619,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -415827,11 +400663,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -415873,11 +400705,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -415895,11 +400723,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -415915,8 +400739,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -415928,13 +400752,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -415968,11 +400792,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -416004,8 +400824,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -416096,11 +400916,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -416123,11 +400939,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -416181,7 +400993,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -416208,7 +401020,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -416224,11 +401036,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -416267,11 +401075,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -416318,8 +401122,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -416340,8 +401144,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -416390,7 +401194,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -416455,13 +401259,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -416489,7 +401293,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -416528,6 +401332,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -416535,11 +401344,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -416563,7 +401367,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -416678,11 +401482,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -416753,11 +401553,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -416784,11 +401580,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -416841,7 +401633,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -416857,7 +401653,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -416886,8 +401682,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -416967,8 +401763,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -416985,11 +401781,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -417033,11 +401825,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -417079,11 +401867,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -417101,11 +401885,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -417121,8 +401901,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -417134,13 +401914,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -417174,11 +401954,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -417210,8 +401986,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -417302,11 +402078,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -417329,11 +402101,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -417387,7 +402155,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -417414,7 +402182,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -417430,11 +402198,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -417473,11 +402237,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -417524,8 +402284,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -417546,8 +402306,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -417596,7 +402356,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -417661,13 +402421,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -417695,7 +402455,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -417734,6 +402494,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -417741,11 +402506,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -417769,7 +402529,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -417884,11 +402644,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -417959,11 +402715,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -417990,11 +402742,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -418047,7 +402795,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -418063,7 +402815,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -418092,8 +402844,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -418173,8 +402925,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -418191,11 +402943,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -418239,11 +402987,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -418285,11 +403029,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -418307,11 +403047,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -418327,8 +403063,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -418340,13 +403076,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -418380,11 +403116,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -418416,8 +403148,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -418508,11 +403240,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -418535,11 +403263,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -418593,7 +403317,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -418620,7 +403344,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -418636,11 +403360,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -418679,11 +403399,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -418730,8 +403446,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -418752,8 +403468,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -418802,7 +403518,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -418867,13 +403583,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -418901,7 +403617,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -418940,6 +403656,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -418947,11 +403668,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -418975,7 +403691,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -419090,11 +403806,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -419165,11 +403877,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -419196,11 +403904,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -419253,7 +403957,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -419269,7 +403977,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -419298,8 +404006,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -419379,8 +404087,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -419397,11 +404105,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -419445,11 +404149,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -419491,11 +404191,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -419513,11 +404209,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -419533,8 +404225,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -419546,13 +404238,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -419586,11 +404278,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -419622,8 +404310,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -419714,11 +404402,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -419741,11 +404425,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -419799,7 +404479,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -419826,7 +404506,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -419842,11 +404522,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -419885,11 +404561,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -419936,8 +404608,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -419958,8 +404630,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -420008,7 +404680,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -420073,13 +404745,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -420107,7 +404779,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -420146,6 +404818,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -420153,11 +404830,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -420181,7 +404853,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -420296,11 +404968,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -420371,11 +405039,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -420402,11 +405066,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -420459,7 +405119,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -420475,7 +405139,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -420504,8 +405168,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -420585,8 +405249,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -420603,11 +405267,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -420651,11 +405311,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -420697,11 +405353,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -420719,11 +405371,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -420739,8 +405387,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -420752,13 +405400,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -420792,11 +405440,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -420828,8 +405472,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -420920,11 +405564,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -420947,11 +405587,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -421005,7 +405641,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -421032,7 +405668,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -421048,11 +405684,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -421091,11 +405723,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -421142,8 +405770,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -421164,8 +405792,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -421214,7 +405842,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -421279,13 +405907,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -421313,7 +405941,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -421352,6 +405980,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -421359,11 +405992,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -421387,7 +406015,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -421502,11 +406130,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -421577,11 +406201,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -421608,11 +406228,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -421665,7 +406281,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -421681,7 +406301,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -421710,8 +406330,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -421791,8 +406411,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -421809,11 +406429,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -421857,11 +406473,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -421903,11 +406515,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -421925,11 +406533,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -421945,8 +406549,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -421958,13 +406562,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -421998,11 +406602,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -422034,8 +406634,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -422126,11 +406726,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -422153,11 +406749,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -422211,7 +406803,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -422238,7 +406830,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -422254,11 +406846,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -422297,11 +406885,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -422348,8 +406932,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -422370,8 +406954,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -422420,7 +407004,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -422485,13 +407069,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -422519,7 +407103,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -422558,6 +407142,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -422565,11 +407154,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -422593,7 +407177,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -422708,11 +407292,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -422783,11 +407363,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -422814,11 +407390,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -422871,7 +407443,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -422887,7 +407463,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -422916,8 +407492,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -422997,8 +407573,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -423015,11 +407591,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -423063,11 +407635,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -423109,11 +407677,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -423131,11 +407695,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -423151,8 +407711,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -423164,13 +407724,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -423204,11 +407764,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -423240,8 +407796,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -423332,11 +407888,7 @@ }, {}, {}, - { - "techniqueID": "T1557", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml" - }, + {}, {}, {}, { @@ -423359,11 +407911,7 @@ {}, {}, {}, - { - "techniqueID": "T1110.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" - }, + {}, {}, {}, { @@ -423417,7 +407965,7 @@ {}, { "techniqueID": "T1114", - "score": 5, + "score": 4, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml" }, { @@ -423444,7 +407992,7 @@ { "techniqueID": "T1071.004", "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, {}, {}, @@ -423460,11 +408008,7 @@ {}, {}, {}, - { - "techniqueID": "T1114.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, + {}, {}, { "techniqueID": "T1547", @@ -423503,11 +408047,7 @@ {}, {}, {}, - { - "techniqueID": "T1542.005", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_software_download_to_network_device.yml" - }, + {}, { "techniqueID": "T1543.003", "score": 1, @@ -423554,8 +408094,8 @@ {}, { "techniqueID": "T1530", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_gcp_storage_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_gcp_storage_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_s3_access_from_a_new_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_s3_bucket_deletion.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml" }, {}, {}, @@ -423576,8 +408116,8 @@ {}, { "techniqueID": "T1082", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, {}, {}, @@ -423626,7 +408166,7 @@ { "techniqueID": "T1190", "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1558", @@ -423691,13 +408231,13 @@ {}, { "techniqueID": "T1021.002", - "score": 6, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "score": 4, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1525", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/new_container_uploaded_to_aws_ecr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml" }, {}, {}, @@ -423725,7 +408265,7 @@ {}, { "techniqueID": "T1021", - "score": 9, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, @@ -423764,6 +408304,11 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, {}, + { + "techniqueID": "T1505.003", + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, {}, {}, {}, @@ -423771,11 +408316,6 @@ {}, {}, {}, - { - "techniqueID": "T1078.001", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/okta_user_logins_from_multiple_cities.yml" - }, {}, {}, {}, @@ -423799,7 +408339,7 @@ { "techniqueID": "T1003.001", "score": 10, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, {}, {}, @@ -423914,11 +408454,7 @@ {}, {}, {}, - { - "techniqueID": "T1020.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -423989,11 +408525,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, - { - "techniqueID": "T1041", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, + {}, {}, { "techniqueID": "T1591", @@ -424020,11 +408552,7 @@ }, {}, {}, - { - "techniqueID": "T1071.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, + {}, {}, {}, {}, @@ -424077,7 +408605,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1566", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, {}, {}, { @@ -424093,7 +408625,7 @@ {}, { "techniqueID": "T1110", - "score": 2, + "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, {}, @@ -424122,8 +408654,8 @@ {}, { "techniqueID": "T1078", - "score": 45, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "score": 42, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, {}, {}, @@ -424203,8 +408735,8 @@ {}, { "techniqueID": "T1203", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, {}, {}, @@ -424221,11 +408753,7 @@ {}, {}, {}, - { - "techniqueID": "T1095", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, + {}, {}, {}, {}, @@ -424269,11 +408797,7 @@ {}, {}, {}, - { - "techniqueID": "T1557.002", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" - }, + {}, {}, {}, {}, @@ -424315,11 +408839,7 @@ {}, {}, {}, - { - "techniqueID": "T1200", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, { "techniqueID": "T1485", @@ -424337,11 +408857,7 @@ "score": 1, "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, - { - "techniqueID": "T1498", - "score": 4, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" - }, + {}, {}, {}, {}, @@ -424357,8 +408873,8 @@ {}, { "techniqueID": "T1071.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "score": 1, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, {}, {}, @@ -424370,13 +408886,13 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml" }, {}, - {}, - {}, { - "techniqueID": "T1018", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "techniqueID": "T1526", + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, + {}, + {}, { "techniqueID": "T1046", "score": 2, @@ -424410,11 +408926,7 @@ {}, {}, {}, - { - "techniqueID": "T1021.001", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" - }, + {}, {}, { "techniqueID": "T1484", @@ -424446,8 +408958,8 @@ {}, { "techniqueID": "T1078.004", - "score": 17, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "score": 15, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, {}, {}, @@ -424524,7 +409036,7 @@ "#096ed7" ], "minValue": 0, - "maxValue": 21 + "maxValue": 24 }, "filters": { "platforms": [ diff --git a/docs/mitre-map/detections.csv b/docs/mitre-map/detections.csv index 9c47571fc5..f599cb017b 100644 --- a/docs/mitre-map/detections.csv +++ b/docs/mitre-map/detections.csv @@ -8799,710 +8799,358 @@ T1060,No,-,40 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,39 T1060,No,-,40 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,39 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,33 -T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml,33 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 +T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,34 T1107,No,-,32 T1070.004,No,-,32 T1107,No,-,32 @@ -10212,13725 +9860,14429 @@ T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,25 T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,25 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,9 -T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,9 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,6 +T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,6 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 T1059.005,No,-,27 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml,25 -T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,25 -T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 +T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,26 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,17 +T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,17 T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,17 @@ -25698,2115 +26050,1411 @@ T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,22 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,21 T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,21 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml,20 -T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml,20 +T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,22 T1036.005,No,-,22 T1036.005,No,-,22 T1036.005,No,-,22 @@ -28169,8 +27817,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28181,8 +27828,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28193,8 +27839,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28205,8 +27850,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28217,8 +27861,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28229,8 +27872,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28241,8 +27883,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28253,8 +27894,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28265,8 +27905,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28277,8 +27916,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28289,8 +27927,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28301,8 +27938,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28313,8 +27949,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28325,8 +27960,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28337,8 +27971,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28349,8 +27982,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28361,8 +27993,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28373,8 +28004,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28385,8 +28015,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28397,8 +28026,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28409,8 +28037,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28421,8 +28048,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28433,8 +28059,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28445,8 +28070,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28457,8 +28081,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28469,8 +28092,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28481,8 +28103,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28493,8 +28114,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28505,8 +28125,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28517,8 +28136,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28529,8 +28147,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28541,8 +28158,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28553,8 +28169,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28565,8 +28180,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28577,8 +28191,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28589,8 +28202,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28601,8 +28213,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28613,8 +28224,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28625,8 +28235,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28637,8 +28246,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28649,8 +28257,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28661,8 +28268,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28673,8 +28279,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28685,8 +28290,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28697,8 +28301,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28709,8 +28312,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28721,8 +28323,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28733,8 +28334,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28745,8 +28345,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28757,8 +28356,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28769,8 +28367,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28781,8 +28378,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28793,8 +28389,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28805,8 +28400,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28817,8 +28411,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28829,8 +28422,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28841,8 +28433,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28853,8 +28444,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28865,8 +28455,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28877,8 +28466,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28889,8 +28477,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28901,8 +28488,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28913,8 +28499,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28925,8 +28510,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28937,8 +28521,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28949,8 +28532,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28961,8 +28543,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28973,8 +28554,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28985,8 +28565,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -28997,8 +28576,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29009,8 +28587,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29021,8 +28598,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29033,8 +28609,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29045,8 +28620,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29057,8 +28631,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29069,8 +28642,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29081,8 +28653,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29093,8 +28664,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29105,8 +28675,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29117,8 +28686,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29129,8 +28697,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29141,8 +28708,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29153,8 +28719,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29165,8 +28730,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29177,8 +28741,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29189,8 +28752,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29201,8 +28763,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29213,8 +28774,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29225,8 +28785,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29237,8 +28796,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29249,8 +28807,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29261,8 +28818,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29273,8 +28829,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29285,8 +28840,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29297,8 +28851,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29309,8 +28862,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29321,8 +28873,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29333,8 +28884,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29345,8 +28895,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29357,8 +28906,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29369,8 +28917,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29381,8 +28928,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29393,8 +28939,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29405,8 +28950,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29417,8 +28961,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29429,8 +28972,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29441,8 +28983,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29453,8 +28994,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29465,8 +29005,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29477,8 +29016,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29489,8 +29027,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29501,8 +29038,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29513,8 +29049,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29525,8 +29060,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29537,8 +29071,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29549,8 +29082,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29561,8 +29093,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29573,8 +29104,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29585,8 +29115,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29597,8 +29126,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29609,8 +29137,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29621,8 +29148,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29633,8 +29159,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29645,8 +29170,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29657,8 +29181,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29669,8 +29192,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29681,8 +29203,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29693,8 +29214,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29705,8 +29225,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29717,8 +29236,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29729,8 +29247,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29741,8 +29258,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29753,8 +29269,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29765,8 +29280,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29777,8 +29291,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29789,8 +29302,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29801,8 +29313,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29813,8 +29324,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29825,8 +29335,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29837,8 +29346,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29849,8 +29357,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29861,8 +29368,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29873,8 +29379,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29885,8 +29390,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29897,8 +29401,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29909,8 +29412,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29921,8 +29423,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29933,8 +29434,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29945,8 +29445,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29957,8 +29456,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29969,8 +29467,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29981,8 +29478,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -29993,8 +29489,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30005,8 +29500,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30017,8 +29511,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30029,8 +29522,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30041,8 +29533,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30053,8 +29544,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30065,8 +29555,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30077,8 +29566,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30089,8 +29577,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30101,8 +29588,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30113,8 +29599,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30125,8 +29610,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30137,8 +29621,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30149,8 +29632,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30161,8 +29643,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30173,8 +29654,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30185,8 +29665,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30197,8 +29676,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30209,8 +29687,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30221,8 +29698,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30233,8 +29709,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30245,8 +29720,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30257,8 +29731,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30269,8 +29742,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30281,8 +29753,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30293,8 +29764,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30305,8 +29775,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30317,8 +29786,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30329,8 +29797,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30341,8 +29808,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30353,8 +29819,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30365,8 +29830,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30377,8 +29841,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30389,8 +29852,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30401,8 +29863,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30413,8 +29874,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30425,8 +29885,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30437,8 +29896,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30449,8 +29907,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30461,8 +29918,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30473,8 +29929,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30485,8 +29940,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30497,8 +29951,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30509,8 +29962,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30521,8 +29973,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30533,8 +29984,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30545,8 +29995,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30557,8 +30006,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30569,8 +30017,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30581,8 +30028,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30593,8 +30039,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30605,8 +30050,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30617,8 +30061,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30629,8 +30072,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30641,8 +30083,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30653,8 +30094,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30665,8 +30105,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30677,8 +30116,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30689,8 +30127,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30701,8 +30138,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30713,8 +30149,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30725,8 +30160,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30737,8 +30171,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30749,8 +30182,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30761,8 +30193,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30773,8 +30204,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30785,8 +30215,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30797,8 +30226,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30809,8 +30237,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30821,8 +30248,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30833,8 +30259,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30845,8 +30270,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30857,8 +30281,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30869,8 +30292,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30881,8 +30303,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30893,8 +30314,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30905,8 +30325,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30917,8 +30336,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30929,8 +30347,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30941,8 +30358,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30953,8 +30369,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30965,8 +30380,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30977,8 +30391,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -30989,8 +30402,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31001,8 +30413,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31013,8 +30424,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31025,8 +30435,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31037,8 +30446,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31049,8 +30457,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31061,8 +30468,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31073,8 +30479,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31085,8 +30490,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31097,8 +30501,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31109,8 +30512,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31121,8 +30523,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31133,8 +30534,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31145,8 +30545,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31157,8 +30556,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31169,8 +30567,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31181,8 +30578,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31193,8 +30589,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31205,8 +30600,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31217,8 +30611,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31229,8 +30622,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31241,8 +30633,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31253,8 +30644,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31265,8 +30655,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31277,8 +30666,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31289,8 +30677,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31301,8 +30688,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31313,8 +30699,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31325,8 +30710,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31337,8 +30721,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31349,8 +30732,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31361,8 +30743,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31373,8 +30754,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31385,8 +30765,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31397,8 +30776,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31409,8 +30787,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31421,8 +30798,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31433,8 +30809,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31445,8 +30820,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31457,8 +30831,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31469,8 +30842,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31481,8 +30853,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31493,8 +30864,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31505,8 +30875,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31517,8 +30886,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31529,8 +30897,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31541,8 +30908,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31553,8 +30919,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31565,8 +30930,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31577,8 +30941,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31589,8 +30952,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31601,8 +30963,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31613,8 +30974,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31625,8 +30985,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31637,8 +30996,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31649,8 +31007,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31661,8 +31018,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31673,8 +31029,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31685,8 +31040,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31697,8 +31051,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31709,8 +31062,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31721,8 +31073,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31733,8 +31084,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31745,8 +31095,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31757,8 +31106,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31769,8 +31117,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31781,8 +31128,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31793,8 +31139,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31805,8 +31150,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31817,8 +31161,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31829,8 +31172,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31841,8 +31183,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31853,8 +31194,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31865,8 +31205,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31877,8 +31216,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31889,8 +31227,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31901,8 +31238,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31913,8 +31249,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31925,8 +31260,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31937,8 +31271,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31949,8 +31282,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31961,8 +31293,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31973,8 +31304,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31985,8 +31315,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -31997,8 +31326,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32009,8 +31337,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32021,8 +31348,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32033,8 +31359,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32045,8 +31370,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32057,8 +31381,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32069,8 +31392,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32081,8 +31403,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32093,8 +31414,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32105,8 +31425,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32117,8 +31436,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32129,8 +31447,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32141,8 +31458,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32153,8 +31469,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32165,8 +31480,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32177,8 +31491,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32189,8 +31502,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32201,8 +31513,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32213,8 +31524,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32225,8 +31535,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32237,8 +31546,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32249,8 +31557,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32261,8 +31568,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32273,8 +31579,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32285,8 +31590,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32297,8 +31601,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32309,8 +31612,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32321,8 +31623,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32333,8 +31634,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32345,8 +31645,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32357,8 +31656,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32369,8 +31667,7 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12 @@ -32381,15 +31678,14 @@ T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12 T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12 T1076,No,-,21 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml,19 -T1021.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml,19 +T1021.001,No,-,21 T1056.001,No,-,20 T1140,No,-,20 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32397,7 +31693,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32405,7 +31701,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32413,7 +31709,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32421,7 +31717,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32429,7 +31725,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32437,7 +31733,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32445,7 +31741,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32453,7 +31749,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32461,7 +31757,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32469,7 +31765,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32477,7 +31773,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32485,7 +31781,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32493,7 +31789,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32501,7 +31797,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32509,7 +31805,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32517,7 +31813,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32525,7 +31821,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32533,7 +31829,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32541,7 +31837,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32549,7 +31845,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32557,7 +31853,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32565,7 +31861,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32573,7 +31869,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32581,7 +31877,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32589,7 +31885,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32597,7 +31893,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32605,7 +31901,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32613,7 +31909,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32621,7 +31917,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32629,7 +31925,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32637,7 +31933,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32645,7 +31941,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32653,7 +31949,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32661,7 +31957,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32669,7 +31965,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32677,7 +31973,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32685,7 +31981,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32693,7 +31989,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32701,7 +31997,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32709,7 +32005,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32717,7 +32013,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32725,7 +32021,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32733,7 +32029,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32741,7 +32037,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32749,7 +32045,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32757,7 +32053,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32765,7 +32061,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32773,7 +32069,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32781,7 +32077,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32789,7 +32085,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32797,7 +32093,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32805,7 +32101,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32813,7 +32109,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32821,7 +32117,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32829,7 +32125,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32837,7 +32133,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32845,7 +32141,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32853,7 +32149,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32861,7 +32157,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32869,7 +32165,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32877,7 +32173,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32885,7 +32181,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32893,7 +32189,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32901,7 +32197,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32909,7 +32205,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32917,7 +32213,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32925,7 +32221,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32933,7 +32229,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32941,7 +32237,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32949,7 +32245,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32957,7 +32253,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32965,7 +32261,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32973,7 +32269,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32981,7 +32277,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32989,7 +32285,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -32997,7 +32293,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33005,7 +32301,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33013,7 +32309,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33021,7 +32317,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33029,7 +32325,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33037,7 +32333,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33045,7 +32341,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33053,7 +32349,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33061,7 +32357,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33069,7 +32365,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33077,7 +32373,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33085,7 +32381,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33093,7 +32389,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33101,7 +32397,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33109,7 +32405,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33117,7 +32413,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33125,7 +32421,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33133,7 +32429,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33141,7 +32437,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33149,7 +32445,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33157,7 +32453,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33165,7 +32461,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33173,7 +32469,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33181,7 +32477,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33189,7 +32485,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33197,7 +32493,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33205,7 +32501,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33213,7 +32509,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33221,7 +32517,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33229,7 +32525,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33237,7 +32533,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33245,7 +32541,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33253,7 +32549,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33261,7 +32557,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33269,7 +32565,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33277,7 +32573,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33285,7 +32581,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33293,7 +32589,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33301,7 +32597,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33309,7 +32605,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33317,7 +32613,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33325,7 +32621,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33333,7 +32629,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33341,7 +32637,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33349,7 +32645,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33357,7 +32653,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33365,7 +32661,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33373,7 +32669,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33381,7 +32677,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33389,7 +32685,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33397,7 +32693,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33405,7 +32701,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33413,7 +32709,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33421,7 +32717,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33429,7 +32725,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33437,7 +32733,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33445,7 +32741,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33453,7 +32749,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33461,7 +32757,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33469,7 +32765,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33477,7 +32773,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33485,7 +32781,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33493,7 +32789,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33501,7 +32797,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33509,7 +32805,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33517,7 +32813,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33525,7 +32821,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33533,7 +32829,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33541,7 +32837,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33549,7 +32845,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33557,7 +32853,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33565,7 +32861,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33573,7 +32869,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33581,7 +32877,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33589,7 +32885,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33597,7 +32893,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33605,7 +32901,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33613,7 +32909,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33621,7 +32917,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33629,7 +32925,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33637,7 +32933,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33645,7 +32941,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33653,7 +32949,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33661,7 +32957,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33669,7 +32965,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33677,7 +32973,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33685,7 +32981,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33693,7 +32989,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33701,7 +32997,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33709,7 +33005,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33717,7 +33013,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33725,7 +33021,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33733,7 +33029,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33741,7 +33037,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33749,7 +33045,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33757,7 +33053,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33765,7 +33061,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33773,7 +33069,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33781,7 +33077,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33789,7 +33085,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33797,7 +33093,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33805,7 +33101,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33813,7 +33109,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33821,7 +33117,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33829,7 +33125,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33837,7 +33133,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33845,7 +33141,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33853,7 +33149,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33861,7 +33157,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33869,7 +33165,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33877,7 +33173,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33885,7 +33181,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33893,7 +33189,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33901,7 +33197,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33909,7 +33205,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33917,7 +33213,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33925,7 +33221,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33933,7 +33229,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33941,7 +33237,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33949,7 +33245,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33957,7 +33253,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33965,7 +33261,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33973,7 +33269,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33981,7 +33277,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33989,7 +33285,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -33997,7 +33293,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34005,7 +33301,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34013,7 +33309,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34021,7 +33317,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34029,7 +33325,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34037,7 +33333,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34045,7 +33341,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34053,7 +33349,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34061,7 +33357,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34069,7 +33365,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34077,7 +33373,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34085,7 +33381,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34093,7 +33389,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34101,7 +33397,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34109,7 +33405,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34117,7 +33413,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34125,7 +33421,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34133,7 +33429,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34141,7 +33437,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34149,7 +33445,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34157,7 +33453,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34165,7 +33461,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34173,7 +33469,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34181,7 +33477,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34189,7 +33485,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34197,7 +33493,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34205,7 +33501,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34213,7 +33509,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34221,7 +33517,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34229,7 +33525,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34237,7 +33533,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34245,7 +33541,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34253,7 +33549,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34261,7 +33557,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34269,7 +33565,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34277,7 +33573,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34285,7 +33581,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34293,7 +33589,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34301,7 +33597,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34309,7 +33605,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34317,7 +33613,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34325,7 +33621,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34333,7 +33629,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34341,7 +33637,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34349,7 +33645,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34357,7 +33653,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34365,7 +33661,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34373,7 +33669,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34381,7 +33677,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34389,7 +33685,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34397,7 +33693,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34405,7 +33701,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34413,7 +33709,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34421,7 +33717,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34429,7 +33725,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34437,7 +33733,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34445,7 +33741,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34453,7 +33749,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34461,7 +33757,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34469,7 +33765,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34477,7 +33773,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34485,7 +33781,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34493,7 +33789,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34501,7 +33797,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34509,7 +33805,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34517,7 +33813,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34525,7 +33821,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34533,7 +33829,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34541,7 +33837,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34549,7 +33845,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34557,7 +33853,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34565,7 +33861,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34573,7 +33869,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34581,7 +33877,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34589,7 +33885,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34597,7 +33893,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34605,7 +33901,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34613,7 +33909,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34621,7 +33917,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34629,7 +33925,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34637,7 +33933,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34645,7 +33941,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34653,7 +33949,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34661,7 +33957,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34669,7 +33965,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34677,7 +33973,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34685,7 +33981,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34693,7 +33989,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34701,7 +33997,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34709,7 +34005,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34717,7 +34013,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34725,7 +34021,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34733,7 +34029,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34741,7 +34037,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34749,7 +34045,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34757,7 +34053,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34765,7 +34061,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34773,7 +34069,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34781,7 +34077,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34789,7 +34085,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34797,7 +34093,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34805,7 +34101,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34813,7 +34109,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34821,7 +34117,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34829,7 +34125,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34837,7 +34133,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34845,7 +34141,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34853,7 +34149,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34861,7 +34157,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34869,7 +34165,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34877,7 +34173,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34885,7 +34181,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34893,7 +34189,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34901,7 +34197,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34909,7 +34205,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34917,7 +34213,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34925,7 +34221,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34933,7 +34229,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34941,7 +34237,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34949,7 +34245,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34957,7 +34253,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34965,7 +34261,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34973,7 +34269,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34981,7 +34277,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34989,7 +34285,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -34997,7 +34293,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35005,7 +34301,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35013,7 +34309,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35021,7 +34317,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35029,7 +34325,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35037,7 +34333,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35045,7 +34341,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35053,7 +34349,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35061,7 +34357,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35069,7 +34365,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35077,7 +34373,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35085,7 +34381,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35093,7 +34389,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35101,7 +34397,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35109,7 +34405,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35117,7 +34413,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35125,7 +34421,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35133,7 +34429,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35141,7 +34437,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35149,7 +34445,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35157,7 +34453,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35165,7 +34461,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35173,7 +34469,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35181,7 +34477,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35189,7 +34485,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1056.001,No,-,20 T1140,No,-,20 @@ -35197,7 +34493,7 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,16 T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,16 -T1018,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml,19 +T1018,No,-,20 T1204.001,No,-,20 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,14 T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,14 @@ -46824,12 +46120,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -46844,12 +46138,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -46864,12 +46156,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -46884,12 +46174,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -46904,12 +46192,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -46924,12 +46210,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -46944,12 +46228,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -46964,12 +46246,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -46984,12 +46264,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47004,12 +46282,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47024,12 +46300,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47044,12 +46318,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47064,12 +46336,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47084,12 +46354,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47104,12 +46372,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47124,12 +46390,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47144,12 +46408,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47164,12 +46426,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47184,12 +46444,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47204,12 +46462,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47224,12 +46480,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47244,12 +46498,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47264,12 +46516,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47284,12 +46534,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47304,12 +46552,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47324,12 +46570,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47344,12 +46588,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47364,12 +46606,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47384,12 +46624,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47404,12 +46642,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47424,12 +46660,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47444,12 +46678,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47464,12 +46696,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47484,12 +46714,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47504,12 +46732,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47524,12 +46750,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47544,12 +46768,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47564,12 +46786,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47584,12 +46804,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47604,12 +46822,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47624,12 +46840,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47644,12 +46858,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47664,12 +46876,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47684,12 +46894,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47704,12 +46912,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47724,12 +46930,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47744,12 +46948,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47764,12 +46966,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47784,12 +46984,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47804,12 +47002,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47824,12 +47020,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47844,12 +47038,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47864,12 +47056,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47884,12 +47074,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47904,12 +47092,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47924,12 +47110,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47944,12 +47128,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47964,12 +47146,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -47984,12 +47164,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48004,12 +47182,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48024,12 +47200,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48044,12 +47218,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48064,12 +47236,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48084,12 +47254,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48104,12 +47272,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48124,12 +47290,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48144,12 +47308,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48164,12 +47326,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48184,12 +47344,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48204,12 +47362,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48224,12 +47380,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48244,12 +47398,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48264,12 +47416,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48284,12 +47434,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48304,12 +47452,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48324,12 +47470,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48344,12 +47488,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48364,12 +47506,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48384,12 +47524,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48404,12 +47542,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48424,12 +47560,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48444,12 +47578,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48464,12 +47596,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48484,12 +47614,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48504,12 +47632,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48524,12 +47650,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48544,12 +47668,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48564,12 +47686,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48584,12 +47704,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48604,12 +47722,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48624,12 +47740,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48644,12 +47758,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48664,12 +47776,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48684,12 +47794,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48704,12 +47812,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48724,12 +47830,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48744,12 +47848,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48764,12 +47866,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48784,12 +47884,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48804,12 +47902,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48824,12 +47920,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48844,12 +47938,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48864,12 +47956,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48884,12 +47974,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48904,12 +47992,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48924,12 +48010,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48944,12 +48028,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48964,12 +48046,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -48984,12 +48064,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49004,12 +48082,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49024,12 +48100,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49044,12 +48118,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49064,12 +48136,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49084,12 +48154,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49104,12 +48172,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49124,12 +48190,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49144,12 +48208,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49164,12 +48226,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49184,12 +48244,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49204,12 +48262,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49224,12 +48280,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49244,12 +48298,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49264,12 +48316,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49284,12 +48334,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49304,12 +48352,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49324,12 +48370,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49344,12 +48388,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49364,12 +48406,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49384,12 +48424,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49404,12 +48442,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49424,12 +48460,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49444,12 +48478,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49464,12 +48496,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49484,12 +48514,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49504,12 +48532,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49524,12 +48550,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49544,12 +48568,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49564,12 +48586,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49584,12 +48604,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49604,12 +48622,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49624,12 +48640,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49644,12 +48658,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49664,12 +48676,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49684,12 +48694,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49704,12 +48712,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49724,12 +48730,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49744,12 +48748,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49764,12 +48766,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49784,12 +48784,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49804,12 +48802,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49824,12 +48820,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49844,12 +48838,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49864,12 +48856,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49884,12 +48874,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49904,12 +48892,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49924,12 +48910,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49944,12 +48928,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49964,12 +48946,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -49984,12 +48964,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50004,12 +48982,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50024,12 +49000,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50044,12 +49018,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50064,12 +49036,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50084,12 +49054,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50104,12 +49072,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50124,12 +49090,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50144,12 +49108,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50164,12 +49126,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50184,12 +49144,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50204,12 +49162,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50224,12 +49180,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50244,12 +49198,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50264,12 +49216,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50284,12 +49234,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50304,12 +49252,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50324,12 +49270,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50344,12 +49288,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50364,12 +49306,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50384,12 +49324,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50404,12 +49342,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50424,12 +49360,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50444,12 +49378,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50464,12 +49396,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50484,12 +49414,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50504,12 +49432,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50524,12 +49450,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50544,12 +49468,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50564,12 +49486,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50584,12 +49504,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50604,12 +49522,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50624,12 +49540,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50644,12 +49558,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50664,12 +49576,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50684,12 +49594,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50704,12 +49612,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50724,12 +49630,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50744,12 +49648,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50764,12 +49666,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50784,12 +49684,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50804,12 +49702,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50824,12 +49720,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50844,12 +49738,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50864,12 +49756,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50884,12 +49774,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50904,12 +49792,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50924,12 +49810,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50944,12 +49828,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50964,12 +49846,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -50984,12 +49864,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51004,12 +49882,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51024,12 +49900,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51044,12 +49918,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51064,12 +49936,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51084,12 +49954,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51104,12 +49972,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51124,12 +49990,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51144,12 +50008,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51164,12 +50026,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51184,12 +50044,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51204,12 +50062,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51224,12 +50080,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51244,12 +50098,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51264,12 +50116,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51284,12 +50134,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51304,12 +50152,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51324,12 +50170,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51344,12 +50188,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51364,12 +50206,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51384,12 +50224,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51404,12 +50242,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51424,12 +50260,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51444,12 +50278,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51464,12 +50296,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51484,12 +50314,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51504,12 +50332,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51524,12 +50350,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51544,12 +50368,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51564,12 +50386,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51584,12 +50404,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51604,12 +50422,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51624,12 +50440,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51644,12 +50458,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51664,12 +50476,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51684,12 +50494,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51704,12 +50512,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51724,12 +50530,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51744,12 +50548,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51764,12 +50566,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51784,12 +50584,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51804,12 +50602,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51824,12 +50620,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51844,12 +50638,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51864,12 +50656,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51884,12 +50674,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51904,12 +50692,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51924,12 +50710,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51944,12 +50728,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51964,12 +50746,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -51984,12 +50764,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52004,12 +50782,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52024,12 +50800,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52044,12 +50818,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52064,12 +50836,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52084,12 +50854,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52104,12 +50872,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52124,12 +50890,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52144,12 +50908,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52164,12 +50926,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52184,12 +50944,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52204,12 +50962,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52224,12 +50980,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52244,12 +50998,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52264,12 +51016,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52284,12 +51034,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52304,12 +51052,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52324,12 +51070,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52344,12 +51088,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52364,12 +51106,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52384,12 +51124,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52404,12 +51142,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52424,12 +51160,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52444,12 +51178,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52464,12 +51196,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52484,12 +51214,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52504,12 +51232,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52524,12 +51250,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52544,12 +51268,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52564,12 +51286,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52584,12 +51304,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52604,12 +51322,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52624,12 +51340,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52644,12 +51358,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52664,12 +51376,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52684,12 +51394,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52704,12 +51412,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52724,12 +51430,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52744,12 +51448,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52764,12 +51466,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52784,12 +51484,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52804,12 +51502,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52824,12 +51520,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52844,12 +51538,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52864,12 +51556,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52884,12 +51574,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52904,12 +51592,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52924,12 +51610,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52944,12 +51628,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52964,12 +51646,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -52984,12 +51664,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53004,12 +51682,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53024,12 +51700,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53044,12 +51718,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53064,12 +51736,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53084,12 +51754,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53104,12 +51772,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53124,12 +51790,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53144,12 +51808,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53164,12 +51826,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53184,12 +51844,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53204,12 +51862,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53224,12 +51880,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53244,12 +51898,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53264,12 +51916,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53284,12 +51934,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53304,12 +51952,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53324,12 +51970,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53344,12 +51988,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53364,12 +52006,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53384,12 +52024,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53404,12 +52042,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53424,12 +52060,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53444,12 +52078,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53464,12 +52096,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53484,12 +52114,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53504,12 +52132,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53524,12 +52150,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53544,12 +52168,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53564,12 +52186,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53584,12 +52204,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53604,12 +52222,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53624,12 +52240,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53644,12 +52258,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53664,12 +52276,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53684,12 +52294,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53704,12 +52312,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53724,12 +52330,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53744,12 +52348,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53764,12 +52366,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53784,12 +52384,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53804,12 +52402,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53824,12 +52420,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53844,12 +52438,10 @@ T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,5 T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,5 T1074.001,No,-,13 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml,7 -T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml,7 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,9 +T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,9 T1085,No,-,13 T1045,No,-,13 T1027.002,No,-,13 @@ -53858,7 +52450,7 @@ T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -53867,7 +52459,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -53875,7 +52467,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -53884,7 +52476,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -53892,7 +52484,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -53901,7 +52493,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -53909,7 +52501,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -53918,7 +52510,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -53926,7 +52518,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -53935,7 +52527,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -53943,7 +52535,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -53952,7 +52544,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -53960,7 +52552,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -53969,7 +52561,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -53977,7 +52569,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -53986,7 +52578,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -53994,7 +52586,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54003,7 +52595,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54011,7 +52603,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54020,7 +52612,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54028,7 +52620,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54037,7 +52629,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54045,7 +52637,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54054,7 +52646,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54062,7 +52654,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54071,7 +52663,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54079,7 +52671,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54088,7 +52680,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54096,7 +52688,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54105,7 +52697,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54113,7 +52705,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54122,7 +52714,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54130,7 +52722,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54139,7 +52731,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54147,7 +52739,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54156,7 +52748,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54164,7 +52756,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54173,7 +52765,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54181,7 +52773,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54190,7 +52782,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54198,7 +52790,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54207,7 +52799,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54215,7 +52807,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54224,7 +52816,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54232,7 +52824,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54241,7 +52833,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54249,7 +52841,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54258,7 +52850,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54266,7 +52858,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54275,7 +52867,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54283,7 +52875,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54292,7 +52884,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54300,7 +52892,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54309,7 +52901,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54317,7 +52909,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54326,7 +52918,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54334,7 +52926,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54343,7 +52935,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54351,7 +52943,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54360,7 +52952,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54368,7 +52960,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54377,7 +52969,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54385,7 +52977,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54394,7 +52986,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54402,7 +52994,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54411,7 +53003,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54419,7 +53011,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54428,7 +53020,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54436,7 +53028,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54445,7 +53037,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54453,7 +53045,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54462,7 +53054,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54470,7 +53062,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54479,7 +53071,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54487,7 +53079,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54496,7 +53088,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54504,7 +53096,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54513,7 +53105,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54521,7 +53113,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54530,7 +53122,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54538,7 +53130,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54547,7 +53139,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54555,7 +53147,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54564,7 +53156,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54572,7 +53164,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54581,7 +53173,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54589,7 +53181,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54598,7 +53190,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54606,7 +53198,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54615,7 +53207,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54623,7 +53215,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54632,7 +53224,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54640,7 +53232,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54649,7 +53241,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54657,7 +53249,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54666,7 +53258,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54674,7 +53266,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54683,7 +53275,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54691,7 +53283,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54700,7 +53292,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54708,7 +53300,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54717,7 +53309,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54725,7 +53317,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54734,7 +53326,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54742,7 +53334,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54751,7 +53343,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54759,7 +53351,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54768,7 +53360,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54776,7 +53368,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54785,7 +53377,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54793,7 +53385,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54802,7 +53394,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54810,7 +53402,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54819,7 +53411,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54827,7 +53419,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54836,7 +53428,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54844,7 +53436,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54853,7 +53445,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54861,7 +53453,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54870,7 +53462,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54878,7 +53470,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54887,7 +53479,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54895,7 +53487,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54904,7 +53496,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54912,7 +53504,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54921,7 +53513,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54929,7 +53521,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54938,7 +53530,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54946,7 +53538,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54955,7 +53547,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54963,7 +53555,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54972,7 +53564,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54980,7 +53572,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -54989,7 +53581,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -54997,7 +53589,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55006,7 +53598,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55014,7 +53606,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55023,7 +53615,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55031,7 +53623,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55040,7 +53632,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55048,7 +53640,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55057,7 +53649,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55065,7 +53657,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55074,7 +53666,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55082,7 +53674,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55091,7 +53683,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55099,7 +53691,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55108,7 +53700,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55116,7 +53708,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55125,7 +53717,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55133,7 +53725,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55142,7 +53734,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55150,7 +53742,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55159,7 +53751,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55167,7 +53759,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55176,7 +53768,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55184,7 +53776,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55193,7 +53785,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55201,7 +53793,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55210,7 +53802,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55218,7 +53810,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55227,7 +53819,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55235,7 +53827,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55244,7 +53836,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55252,7 +53844,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55261,7 +53853,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55269,7 +53861,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55278,7 +53870,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55286,7 +53878,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55295,7 +53887,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55303,7 +53895,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55312,7 +53904,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55320,7 +53912,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55329,7 +53921,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55337,7 +53929,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55346,7 +53938,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55354,7 +53946,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55363,7 +53955,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55371,7 +53963,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55380,7 +53972,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55388,7 +53980,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55397,7 +53989,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55405,7 +53997,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55414,7 +54006,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55422,7 +54014,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55431,7 +54023,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55439,7 +54031,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55448,7 +54040,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55456,7 +54048,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55465,7 +54057,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55473,7 +54065,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55482,7 +54074,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55490,7 +54082,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55499,7 +54091,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55507,7 +54099,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55516,7 +54108,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55524,7 +54116,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55533,7 +54125,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55541,7 +54133,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55550,7 +54142,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55558,7 +54150,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55567,7 +54159,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55575,7 +54167,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55584,7 +54176,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55592,7 +54184,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55601,7 +54193,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55609,7 +54201,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55618,7 +54210,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55626,7 +54218,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55635,7 +54227,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55643,7 +54235,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55652,7 +54244,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55660,7 +54252,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55669,7 +54261,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55677,7 +54269,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55686,7 +54278,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55694,7 +54286,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55703,7 +54295,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55711,7 +54303,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55720,7 +54312,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55728,7 +54320,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55737,7 +54329,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55745,7 +54337,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55754,7 +54346,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55762,7 +54354,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55771,7 +54363,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55779,7 +54371,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55788,7 +54380,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55796,7 +54388,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55805,7 +54397,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55813,7 +54405,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55822,7 +54414,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55830,7 +54422,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55839,7 +54431,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55847,7 +54439,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55856,7 +54448,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55864,7 +54456,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55873,7 +54465,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55881,7 +54473,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55890,7 +54482,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55898,7 +54490,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55907,7 +54499,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55915,7 +54507,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55924,7 +54516,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55932,7 +54524,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55941,7 +54533,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55949,7 +54541,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55958,7 +54550,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55966,7 +54558,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55975,7 +54567,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -55983,7 +54575,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -55992,7 +54584,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56000,7 +54592,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56009,7 +54601,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56017,7 +54609,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56026,7 +54618,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56034,7 +54626,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56043,7 +54635,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56051,7 +54643,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56060,7 +54652,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56068,7 +54660,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56077,7 +54669,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56085,7 +54677,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56094,7 +54686,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56102,7 +54694,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56111,7 +54703,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56119,7 +54711,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56128,7 +54720,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56136,7 +54728,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56145,7 +54737,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56153,7 +54745,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56162,7 +54754,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56170,7 +54762,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56179,7 +54771,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56187,7 +54779,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56196,7 +54788,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56204,7 +54796,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56213,7 +54805,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56221,7 +54813,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56230,7 +54822,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56238,7 +54830,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56247,7 +54839,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56255,7 +54847,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56264,7 +54856,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56272,7 +54864,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56281,7 +54873,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56289,7 +54881,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56298,7 +54890,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56306,7 +54898,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56315,7 +54907,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56323,7 +54915,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56332,7 +54924,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56340,7 +54932,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56349,7 +54941,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56357,7 +54949,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56366,7 +54958,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56374,7 +54966,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56383,7 +54975,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56391,7 +54983,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56400,7 +54992,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56408,7 +55000,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56417,7 +55009,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56425,7 +55017,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56434,7 +55026,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56442,7 +55034,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56451,7 +55043,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56459,7 +55051,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56468,7 +55060,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56476,7 +55068,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56485,7 +55077,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56493,7 +55085,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56502,7 +55094,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56510,7 +55102,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56519,7 +55111,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56527,7 +55119,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56536,7 +55128,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56544,7 +55136,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56553,7 +55145,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56561,7 +55153,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56570,7 +55162,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56578,7 +55170,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56587,7 +55179,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56595,7 +55187,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56604,7 +55196,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56612,7 +55204,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56621,7 +55213,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56629,7 +55221,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56638,7 +55230,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56646,7 +55238,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56655,7 +55247,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56663,7 +55255,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56672,7 +55264,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56680,7 +55272,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56689,7 +55281,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56697,7 +55289,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56706,7 +55298,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56714,7 +55306,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56723,7 +55315,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56731,7 +55323,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56740,7 +55332,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56748,7 +55340,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56757,7 +55349,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56765,7 +55357,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56774,7 +55366,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56782,7 +55374,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56791,7 +55383,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56799,7 +55391,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56808,7 +55400,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56816,7 +55408,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56825,7 +55417,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56833,7 +55425,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56842,7 +55434,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56850,7 +55442,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56859,7 +55451,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56867,7 +55459,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56876,7 +55468,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56884,7 +55476,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56893,7 +55485,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56901,7 +55493,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56910,7 +55502,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56918,7 +55510,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56927,7 +55519,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56935,7 +55527,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56944,7 +55536,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56952,7 +55544,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56961,7 +55553,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56969,7 +55561,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56978,7 +55570,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -56986,7 +55578,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -56995,7 +55587,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57003,7 +55595,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57012,7 +55604,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57020,7 +55612,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57029,7 +55621,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57037,7 +55629,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57046,7 +55638,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57054,7 +55646,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57063,7 +55655,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57071,7 +55663,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57080,7 +55672,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57088,7 +55680,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57097,7 +55689,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57105,7 +55697,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57114,7 +55706,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57122,7 +55714,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57131,7 +55723,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57139,7 +55731,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57148,7 +55740,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57156,7 +55748,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57165,7 +55757,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57173,7 +55765,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57182,7 +55774,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57190,7 +55782,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57199,7 +55791,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57207,7 +55799,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57216,7 +55808,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57224,7 +55816,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57233,7 +55825,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57241,7 +55833,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57250,7 +55842,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57258,7 +55850,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57267,7 +55859,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57275,7 +55867,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57284,7 +55876,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57292,7 +55884,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57301,7 +55893,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57309,7 +55901,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57318,7 +55910,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57326,7 +55918,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57335,7 +55927,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57343,7 +55935,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57352,7 +55944,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57360,7 +55952,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57369,7 +55961,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57377,7 +55969,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57386,7 +55978,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57394,7 +55986,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57403,7 +55995,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57411,7 +56003,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57420,7 +56012,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57428,7 +56020,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57437,7 +56029,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57445,7 +56037,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57454,7 +56046,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57462,7 +56054,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57471,7 +56063,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57479,7 +56071,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57488,7 +56080,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57496,7 +56088,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57505,7 +56097,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57513,7 +56105,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57522,7 +56114,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57530,7 +56122,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57539,7 +56131,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57547,7 +56139,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57556,7 +56148,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57564,7 +56156,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57573,7 +56165,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57581,7 +56173,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57590,7 +56182,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57598,7 +56190,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57607,7 +56199,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57615,7 +56207,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57624,7 +56216,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57632,7 +56224,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57641,7 +56233,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57649,7 +56241,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57658,7 +56250,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57666,7 +56258,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57675,7 +56267,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57683,7 +56275,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57692,7 +56284,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57700,7 +56292,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57709,7 +56301,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57717,7 +56309,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57726,7 +56318,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57734,7 +56326,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57743,7 +56335,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57751,7 +56343,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57760,7 +56352,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57768,7 +56360,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57777,7 +56369,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57785,7 +56377,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57794,7 +56386,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57802,7 +56394,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57811,7 +56403,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57819,7 +56411,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57828,7 +56420,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57836,7 +56428,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57845,7 +56437,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57853,7 +56445,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57862,7 +56454,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57870,7 +56462,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57879,7 +56471,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57887,7 +56479,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57896,7 +56488,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57904,7 +56496,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57913,7 +56505,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57921,7 +56513,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57930,7 +56522,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57938,7 +56530,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57947,7 +56539,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57955,7 +56547,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57964,7 +56556,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57972,7 +56564,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57981,7 +56573,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -57989,7 +56581,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -57998,7 +56590,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58006,7 +56598,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58015,7 +56607,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58023,7 +56615,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58032,7 +56624,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58040,7 +56632,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58049,7 +56641,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58057,7 +56649,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58066,7 +56658,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58074,7 +56666,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58083,7 +56675,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58091,7 +56683,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58100,7 +56692,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58108,7 +56700,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58117,7 +56709,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58125,7 +56717,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58134,7 +56726,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58142,7 +56734,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58151,7 +56743,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58159,7 +56751,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58168,7 +56760,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58176,7 +56768,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58185,7 +56777,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58193,7 +56785,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58202,7 +56794,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58210,7 +56802,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58219,7 +56811,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58227,7 +56819,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58236,7 +56828,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58244,7 +56836,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58253,7 +56845,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58261,7 +56853,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58270,7 +56862,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58278,7 +56870,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58287,7 +56879,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58295,7 +56887,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58304,7 +56896,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58312,7 +56904,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58321,7 +56913,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58329,7 +56921,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58338,7 +56930,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58346,7 +56938,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58355,7 +56947,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58363,7 +56955,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58372,7 +56964,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58380,7 +56972,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58389,7 +56981,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58397,7 +56989,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58406,7 +56998,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58414,7 +57006,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58423,7 +57015,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58431,7 +57023,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58440,7 +57032,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58448,7 +57040,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58457,7 +57049,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58465,7 +57057,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58474,7 +57066,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58482,7 +57074,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58491,7 +57083,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58499,7 +57091,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58508,7 +57100,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58516,7 +57108,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58525,7 +57117,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58533,7 +57125,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58542,7 +57134,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58550,7 +57142,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58559,7 +57151,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58567,7 +57159,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58576,7 +57168,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58584,7 +57176,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58593,7 +57185,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58601,7 +57193,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58610,7 +57202,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58618,7 +57210,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58627,7 +57219,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58635,7 +57227,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58644,7 +57236,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58652,7 +57244,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58661,7 +57253,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58669,7 +57261,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58678,7 +57270,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58686,7 +57278,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58695,7 +57287,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58703,7 +57295,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58712,7 +57304,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58720,7 +57312,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58729,7 +57321,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58737,7 +57329,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58746,7 +57338,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58754,7 +57346,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58763,7 +57355,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58771,7 +57363,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58780,7 +57372,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58788,7 +57380,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58797,7 +57389,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58805,7 +57397,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58814,7 +57406,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58822,7 +57414,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58831,7 +57423,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58839,7 +57431,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58848,7 +57440,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58856,7 +57448,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58865,7 +57457,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58873,7 +57465,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58882,7 +57474,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58890,7 +57482,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58899,7 +57491,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58907,7 +57499,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58916,7 +57508,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58924,7 +57516,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58933,7 +57525,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58941,7 +57533,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58950,7 +57542,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58958,7 +57550,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58967,7 +57559,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58975,7 +57567,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -58984,7 +57576,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -58992,7 +57584,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59001,7 +57593,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59009,7 +57601,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59018,7 +57610,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59026,7 +57618,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59035,7 +57627,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59043,7 +57635,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59052,7 +57644,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59060,7 +57652,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59069,7 +57661,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59077,7 +57669,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59086,7 +57678,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59094,7 +57686,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59103,7 +57695,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59111,7 +57703,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59120,7 +57712,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59128,7 +57720,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59137,7 +57729,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59145,7 +57737,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59154,7 +57746,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59162,7 +57754,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59171,7 +57763,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59179,7 +57771,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59188,7 +57780,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59196,7 +57788,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59205,7 +57797,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59213,7 +57805,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59222,7 +57814,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59230,7 +57822,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59239,7 +57831,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59247,7 +57839,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59256,7 +57848,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59264,7 +57856,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59273,7 +57865,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59281,7 +57873,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59290,7 +57882,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59298,7 +57890,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59307,7 +57899,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59315,7 +57907,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59324,7 +57916,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59332,7 +57924,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59341,7 +57933,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59349,7 +57941,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59358,7 +57950,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59366,7 +57958,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59375,7 +57967,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59383,7 +57975,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59392,7 +57984,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59400,7 +57992,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59409,7 +58001,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59417,7 +58009,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59426,7 +58018,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59434,7 +58026,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59443,7 +58035,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59451,7 +58043,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59460,7 +58052,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59468,7 +58060,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59477,7 +58069,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59485,7 +58077,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59494,7 +58086,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59502,7 +58094,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59511,7 +58103,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59519,7 +58111,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59528,7 +58120,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59536,7 +58128,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59545,7 +58137,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59553,7 +58145,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59562,7 +58154,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59570,7 +58162,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59579,7 +58171,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59587,7 +58179,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59596,7 +58188,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59604,7 +58196,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59613,7 +58205,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59621,7 +58213,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59630,7 +58222,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59638,7 +58230,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59647,7 +58239,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59655,7 +58247,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59664,7 +58256,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59672,7 +58264,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59681,7 +58273,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59689,7 +58281,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59698,7 +58290,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59706,7 +58298,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59715,7 +58307,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59723,7 +58315,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59732,7 +58324,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59740,7 +58332,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59749,7 +58341,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59757,7 +58349,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59766,7 +58358,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59774,7 +58366,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59783,7 +58375,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59791,7 +58383,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59800,7 +58392,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59808,7 +58400,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59817,7 +58409,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -59825,7 +58417,7 @@ T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 T1063,No,-,12 -T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml,11 +T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,11 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,9 T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,9 @@ -59834,7 +58426,7 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,9 T1560,No,-,12 T1136.002,No,-,12 -T1041,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml,11 +T1041,No,-,12 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 @@ -60896,1060 +59488,1060 @@ T1571,No,-,11 T1073,No,-,11 T1574.002,No,-,11 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1119,No,-,10 -T1505.003,No,-,10 +T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,9 T1100,No,-,10 T1143,No,-,9 T1559.002,No,-,9 @@ -69702,7 +68294,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -69726,7 +68318,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -69750,7 +68342,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -69774,7 +68366,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -69798,7 +68390,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -69822,7 +68414,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -69846,7 +68438,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -69870,7 +68462,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -69894,7 +68486,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -69918,7 +68510,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -69942,7 +68534,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -69966,7 +68558,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -69990,7 +68582,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70014,7 +68606,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70038,7 +68630,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70062,7 +68654,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70086,7 +68678,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70110,7 +68702,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70134,7 +68726,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70158,7 +68750,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70182,7 +68774,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70206,7 +68798,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70230,7 +68822,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70254,7 +68846,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70278,7 +68870,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70302,7 +68894,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70326,7 +68918,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70350,7 +68942,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70374,7 +68966,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70398,7 +68990,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70422,7 +69014,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70446,7 +69038,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70470,7 +69062,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70494,7 +69086,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70518,7 +69110,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70542,7 +69134,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70566,7 +69158,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70590,7 +69182,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70614,7 +69206,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70638,7 +69230,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70662,7 +69254,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70686,7 +69278,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70710,7 +69302,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70734,7 +69326,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70758,7 +69350,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70782,7 +69374,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70806,7 +69398,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70830,7 +69422,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70854,7 +69446,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70878,7 +69470,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70902,7 +69494,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70926,7 +69518,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70950,7 +69542,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70974,7 +69566,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -70998,7 +69590,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71022,7 +69614,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71046,7 +69638,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71070,7 +69662,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71094,7 +69686,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71118,7 +69710,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71142,7 +69734,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71166,7 +69758,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71190,7 +69782,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71214,7 +69806,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71238,7 +69830,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71262,7 +69854,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71286,7 +69878,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71310,7 +69902,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71334,7 +69926,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71358,7 +69950,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71382,7 +69974,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71406,7 +69998,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71430,7 +70022,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71454,7 +70046,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71478,7 +70070,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71502,7 +70094,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71526,7 +70118,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71550,7 +70142,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71574,7 +70166,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71598,7 +70190,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71622,7 +70214,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71646,7 +70238,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71670,7 +70262,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71694,7 +70286,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71718,7 +70310,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71742,7 +70334,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71766,7 +70358,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71790,7 +70382,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71814,7 +70406,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71838,7 +70430,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71862,7 +70454,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71886,7 +70478,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71910,7 +70502,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71934,7 +70526,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71958,7 +70550,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -71982,7 +70574,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72006,7 +70598,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72030,7 +70622,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72054,7 +70646,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72078,7 +70670,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72102,7 +70694,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72126,7 +70718,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72150,7 +70742,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72174,7 +70766,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72198,7 +70790,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72222,7 +70814,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72246,7 +70838,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72270,7 +70862,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72294,7 +70886,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72318,7 +70910,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72342,7 +70934,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72366,7 +70958,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72390,7 +70982,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72414,7 +71006,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72438,7 +71030,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72462,7 +71054,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72486,7 +71078,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72510,7 +71102,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72534,7 +71126,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72558,7 +71150,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72582,7 +71174,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72606,7 +71198,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72630,7 +71222,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72654,7 +71246,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72678,7 +71270,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72702,7 +71294,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72726,7 +71318,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72750,7 +71342,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72774,7 +71366,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72798,7 +71390,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72822,7 +71414,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72846,7 +71438,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72870,7 +71462,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72894,7 +71486,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72918,7 +71510,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72942,7 +71534,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72966,7 +71558,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -72990,7 +71582,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73014,7 +71606,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73038,7 +71630,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73062,7 +71654,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73086,7 +71678,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73110,7 +71702,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73134,7 +71726,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73158,7 +71750,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73182,7 +71774,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73206,7 +71798,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73230,7 +71822,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73254,7 +71846,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73278,7 +71870,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73302,7 +71894,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73326,7 +71918,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73350,7 +71942,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73374,7 +71966,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73398,7 +71990,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73422,7 +72014,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73446,7 +72038,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73470,7 +72062,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73494,7 +72086,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73518,7 +72110,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73542,7 +72134,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73566,7 +72158,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73590,7 +72182,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73614,7 +72206,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73638,7 +72230,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73662,7 +72254,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73686,7 +72278,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73710,7 +72302,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73734,7 +72326,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73758,7 +72350,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73782,7 +72374,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73806,7 +72398,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73830,7 +72422,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73854,7 +72446,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73878,7 +72470,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73902,7 +72494,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73926,7 +72518,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73950,7 +72542,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73974,7 +72566,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -73998,7 +72590,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74022,7 +72614,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74046,7 +72638,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74070,7 +72662,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74094,7 +72686,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74118,7 +72710,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74142,7 +72734,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74166,7 +72758,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74190,7 +72782,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74214,7 +72806,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74238,7 +72830,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74262,7 +72854,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74286,7 +72878,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74310,7 +72902,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74334,7 +72926,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74358,7 +72950,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74382,7 +72974,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74406,7 +72998,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74430,7 +73022,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74454,7 +73046,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74478,7 +73070,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74502,7 +73094,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74526,7 +73118,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74550,7 +73142,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74574,7 +73166,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74598,7 +73190,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74622,7 +73214,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74646,7 +73238,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74670,7 +73262,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74694,7 +73286,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74718,7 +73310,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74742,7 +73334,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74766,7 +73358,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74790,7 +73382,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74814,7 +73406,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74838,7 +73430,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74862,7 +73454,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74886,7 +73478,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74910,7 +73502,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74934,7 +73526,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74958,7 +73550,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -74982,7 +73574,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75006,7 +73598,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75030,7 +73622,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75054,7 +73646,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75078,7 +73670,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75102,7 +73694,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75126,7 +73718,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75150,7 +73742,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75174,7 +73766,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75198,7 +73790,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75222,7 +73814,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75246,7 +73838,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75270,7 +73862,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75294,7 +73886,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75318,7 +73910,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75342,7 +73934,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75366,7 +73958,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75390,7 +73982,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75414,7 +74006,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75438,7 +74030,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75462,7 +74054,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75486,7 +74078,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75510,7 +74102,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75534,7 +74126,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75558,7 +74150,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75582,7 +74174,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75606,7 +74198,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75630,7 +74222,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75654,7 +74246,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75678,7 +74270,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75702,7 +74294,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75726,7 +74318,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75750,7 +74342,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75774,7 +74366,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75798,7 +74390,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75822,7 +74414,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75846,7 +74438,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75870,7 +74462,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75894,7 +74486,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75918,7 +74510,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75942,7 +74534,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75966,7 +74558,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -75990,7 +74582,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76014,7 +74606,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76038,7 +74630,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76062,7 +74654,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76086,7 +74678,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76110,7 +74702,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76134,7 +74726,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76158,7 +74750,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76182,7 +74774,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76206,7 +74798,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76230,7 +74822,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76254,7 +74846,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76278,7 +74870,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76302,7 +74894,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76326,7 +74918,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76350,7 +74942,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76374,7 +74966,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76398,7 +74990,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76422,7 +75014,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76446,7 +75038,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76470,7 +75062,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76494,7 +75086,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76518,7 +75110,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76542,7 +75134,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76566,7 +75158,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76590,7 +75182,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76614,7 +75206,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76638,7 +75230,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76662,7 +75254,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76686,7 +75278,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76710,7 +75302,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76734,7 +75326,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76758,7 +75350,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76782,7 +75374,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76806,7 +75398,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76830,7 +75422,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76854,7 +75446,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76878,7 +75470,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76902,7 +75494,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76926,7 +75518,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76950,7 +75542,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76974,7 +75566,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -76998,7 +75590,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77022,7 +75614,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77046,7 +75638,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77070,7 +75662,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77094,7 +75686,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77118,7 +75710,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77142,7 +75734,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77166,7 +75758,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77190,7 +75782,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77214,7 +75806,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77238,7 +75830,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77262,7 +75854,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77286,7 +75878,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77310,7 +75902,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77334,7 +75926,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77358,7 +75950,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77382,7 +75974,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77406,7 +75998,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77430,7 +76022,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77454,7 +76046,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77478,7 +76070,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77502,7 +76094,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77526,7 +76118,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77550,7 +76142,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77574,7 +76166,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77598,7 +76190,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77622,7 +76214,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77646,7 +76238,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77670,7 +76262,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77694,7 +76286,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77718,7 +76310,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77742,7 +76334,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77766,7 +76358,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77790,7 +76382,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77814,7 +76406,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77838,7 +76430,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77862,7 +76454,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77886,7 +76478,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77910,7 +76502,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77934,7 +76526,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77958,7 +76550,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -77982,7 +76574,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -78006,7 +76598,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -78030,7 +76622,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -78054,7 +76646,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -78078,7 +76670,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -78102,7 +76694,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -78126,7 +76718,7 @@ T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5 T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5 T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,6 -T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml,6 +T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,6 T1003.004,No,-,8 T1137,No,-,8 T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,6 @@ -99625,7 +98217,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -99652,7 +98244,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -99679,7 +98271,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -99706,7 +98298,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -99733,7 +98325,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -99760,7 +98352,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -99787,7 +98379,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -99814,7 +98406,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -99841,7 +98433,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -99868,7 +98460,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -99895,7 +98487,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -99922,7 +98514,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -99949,7 +98541,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -99976,7 +98568,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100003,7 +98595,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100030,7 +98622,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100057,7 +98649,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100084,7 +98676,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100111,7 +98703,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100138,7 +98730,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100165,7 +98757,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100192,7 +98784,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100219,7 +98811,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100246,7 +98838,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100273,7 +98865,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100300,7 +98892,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100327,7 +98919,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100354,7 +98946,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100381,7 +98973,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100408,7 +99000,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100435,7 +99027,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100462,7 +99054,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100489,7 +99081,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100516,7 +99108,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100543,7 +99135,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100570,7 +99162,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100597,7 +99189,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100624,7 +99216,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100651,7 +99243,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100678,7 +99270,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100705,7 +99297,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100732,7 +99324,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100759,7 +99351,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100786,7 +99378,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100813,7 +99405,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100840,7 +99432,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100867,7 +99459,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100894,7 +99486,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100921,7 +99513,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100948,7 +99540,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -100975,7 +99567,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101002,7 +99594,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101029,7 +99621,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101056,7 +99648,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101083,7 +99675,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101110,7 +99702,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101137,7 +99729,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101164,7 +99756,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101191,7 +99783,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101218,7 +99810,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101245,7 +99837,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101272,7 +99864,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101299,7 +99891,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101326,7 +99918,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101353,7 +99945,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101380,7 +99972,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101407,7 +99999,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101434,7 +100026,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101461,7 +100053,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101488,7 +100080,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101515,7 +100107,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101542,7 +100134,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101569,7 +100161,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101596,7 +100188,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101623,7 +100215,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101650,7 +100242,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101677,7 +100269,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101704,7 +100296,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101731,7 +100323,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101758,7 +100350,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101785,7 +100377,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101812,7 +100404,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101839,7 +100431,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101866,7 +100458,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101893,7 +100485,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101920,7 +100512,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101947,7 +100539,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -101974,7 +100566,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102001,7 +100593,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102028,7 +100620,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102055,7 +100647,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102082,7 +100674,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102109,7 +100701,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102136,7 +100728,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102163,7 +100755,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102190,7 +100782,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102217,7 +100809,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102244,7 +100836,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102271,7 +100863,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102298,7 +100890,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102325,7 +100917,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102352,7 +100944,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102379,7 +100971,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102406,7 +100998,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102433,7 +101025,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102460,7 +101052,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102487,7 +101079,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102514,7 +101106,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102541,7 +101133,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102568,7 +101160,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102595,7 +101187,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102622,7 +101214,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102649,7 +101241,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102676,7 +101268,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102703,7 +101295,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102730,7 +101322,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102757,7 +101349,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102784,7 +101376,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102811,7 +101403,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102838,7 +101430,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102865,7 +101457,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102892,7 +101484,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102919,7 +101511,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102946,7 +101538,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -102973,7 +101565,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103000,7 +101592,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103027,7 +101619,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103054,7 +101646,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103081,7 +101673,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103108,7 +101700,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103135,7 +101727,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103162,7 +101754,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103189,7 +101781,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103216,7 +101808,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103243,7 +101835,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103270,7 +101862,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103297,7 +101889,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103324,7 +101916,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103351,7 +101943,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103378,7 +101970,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103405,7 +101997,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103432,7 +102024,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103459,7 +102051,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103486,7 +102078,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103513,7 +102105,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103540,7 +102132,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103567,7 +102159,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103594,7 +102186,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103621,7 +102213,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103648,7 +102240,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103675,7 +102267,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103702,7 +102294,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103729,7 +102321,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103756,7 +102348,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103783,7 +102375,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103810,7 +102402,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103837,7 +102429,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103864,7 +102456,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103891,7 +102483,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103918,7 +102510,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103945,7 +102537,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103972,7 +102564,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -103999,7 +102591,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104026,7 +102618,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104053,7 +102645,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104080,7 +102672,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104107,7 +102699,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104134,7 +102726,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104161,7 +102753,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104188,7 +102780,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104215,7 +102807,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104242,7 +102834,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104269,7 +102861,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104296,7 +102888,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104323,7 +102915,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104350,7 +102942,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104377,7 +102969,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104404,7 +102996,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104431,7 +103023,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104458,7 +103050,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104485,7 +103077,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104512,7 +103104,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104539,7 +103131,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104566,7 +103158,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104593,7 +103185,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104620,7 +103212,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104647,7 +103239,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104674,7 +103266,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104701,7 +103293,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104728,7 +103320,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104755,7 +103347,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104782,7 +103374,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104809,7 +103401,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104836,7 +103428,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104863,7 +103455,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104890,7 +103482,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104917,7 +103509,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104944,7 +103536,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104971,7 +103563,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -104998,7 +103590,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105025,7 +103617,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105052,7 +103644,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105079,7 +103671,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105106,7 +103698,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105133,7 +103725,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105160,7 +103752,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105187,7 +103779,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105214,7 +103806,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105241,7 +103833,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105268,7 +103860,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105295,7 +103887,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105322,7 +103914,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105349,7 +103941,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105376,7 +103968,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105403,7 +103995,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105430,7 +104022,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105457,7 +104049,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105484,7 +104076,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105511,7 +104103,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105538,7 +104130,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105565,7 +104157,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105592,7 +104184,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105619,7 +104211,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105646,7 +104238,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105673,7 +104265,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105700,7 +104292,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105727,7 +104319,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105754,7 +104346,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105781,7 +104373,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105808,7 +104400,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105835,7 +104427,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105862,7 +104454,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105889,7 +104481,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105916,7 +104508,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105943,7 +104535,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105970,7 +104562,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -105997,7 +104589,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106024,7 +104616,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106051,7 +104643,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106078,7 +104670,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106105,7 +104697,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106132,7 +104724,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106159,7 +104751,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106186,7 +104778,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106213,7 +104805,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106240,7 +104832,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106267,7 +104859,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106294,7 +104886,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106321,7 +104913,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106348,7 +104940,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106375,7 +104967,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106402,7 +104994,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106429,7 +105021,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106456,7 +105048,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106483,7 +105075,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106510,7 +105102,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106537,7 +105129,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106564,7 +105156,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106591,7 +105183,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106618,7 +105210,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106645,7 +105237,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106672,7 +105264,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106699,7 +105291,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106726,7 +105318,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106753,7 +105345,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106780,7 +105372,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106807,7 +105399,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106834,7 +105426,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106861,7 +105453,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106888,7 +105480,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106915,7 +105507,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106942,7 +105534,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106969,7 +105561,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -106996,7 +105588,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107023,7 +105615,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107050,7 +105642,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107077,7 +105669,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107104,7 +105696,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107131,7 +105723,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107158,7 +105750,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107185,7 +105777,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107212,7 +105804,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107239,7 +105831,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107266,7 +105858,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107293,7 +105885,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107320,7 +105912,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107347,7 +105939,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107374,7 +105966,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107401,7 +105993,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107428,7 +106020,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107455,7 +106047,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107482,7 +106074,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107509,7 +106101,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107536,7 +106128,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107563,7 +106155,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107590,7 +106182,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107617,7 +106209,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107644,7 +106236,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107671,7 +106263,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107698,7 +106290,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107725,7 +106317,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107752,7 +106344,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107779,7 +106371,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107806,7 +106398,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107833,7 +106425,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107860,7 +106452,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107887,7 +106479,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107914,7 +106506,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107941,7 +106533,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107968,7 +106560,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -107995,7 +106587,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108022,7 +106614,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108049,7 +106641,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108076,7 +106668,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108103,7 +106695,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108130,7 +106722,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108157,7 +106749,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108184,7 +106776,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108211,7 +106803,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108238,7 +106830,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108265,7 +106857,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108292,7 +106884,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108319,7 +106911,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108346,7 +106938,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108373,7 +106965,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108400,7 +106992,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108427,7 +107019,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108454,7 +107046,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108481,7 +107073,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108508,7 +107100,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108535,7 +107127,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108562,7 +107154,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108589,7 +107181,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108616,7 +107208,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108643,7 +107235,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108670,7 +107262,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108697,7 +107289,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108724,7 +107316,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108751,7 +107343,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108778,7 +107370,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108805,7 +107397,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108832,7 +107424,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108859,7 +107451,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108886,7 +107478,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108913,7 +107505,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108940,7 +107532,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108967,7 +107559,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -108994,7 +107586,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -109021,7 +107613,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -109048,7 +107640,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -109075,7 +107667,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -109102,7 +107694,7 @@ T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,1 T1020,No,-,5 T1015,No,-,5 -T1566,No,-,5 +T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1 T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1 @@ -109133,7 +107725,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109146,7 +107738,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109172,7 +107764,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109185,7 +107777,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109211,7 +107803,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109224,7 +107816,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109250,7 +107842,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109263,7 +107855,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109289,7 +107881,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109302,7 +107894,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109328,7 +107920,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109341,7 +107933,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109367,7 +107959,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109380,7 +107972,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109406,7 +107998,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109419,7 +108011,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109445,7 +108037,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109458,7 +108050,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109484,7 +108076,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109497,7 +108089,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109523,7 +108115,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109536,7 +108128,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109562,7 +108154,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109575,7 +108167,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109601,7 +108193,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109614,7 +108206,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109640,7 +108232,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109653,7 +108245,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109679,7 +108271,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109692,7 +108284,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109718,7 +108310,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109731,7 +108323,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109757,7 +108349,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109770,7 +108362,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109796,7 +108388,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109809,7 +108401,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109835,7 +108427,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109848,7 +108440,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109874,7 +108466,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109887,7 +108479,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109913,7 +108505,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109926,7 +108518,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109952,7 +108544,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -109965,7 +108557,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -109991,7 +108583,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110004,7 +108596,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110030,7 +108622,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110043,7 +108635,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110069,7 +108661,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110082,7 +108674,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110108,7 +108700,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110121,7 +108713,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110147,7 +108739,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110160,7 +108752,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110186,7 +108778,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110199,7 +108791,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110225,7 +108817,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110238,7 +108830,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110264,7 +108856,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110277,7 +108869,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110303,7 +108895,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110316,7 +108908,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110342,7 +108934,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110355,7 +108947,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110381,7 +108973,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110394,7 +108986,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110420,7 +109012,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110433,7 +109025,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110459,7 +109051,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110472,7 +109064,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110498,7 +109090,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110511,7 +109103,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110537,7 +109129,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110550,7 +109142,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110576,7 +109168,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110589,7 +109181,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110615,7 +109207,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110628,7 +109220,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110654,7 +109246,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110667,7 +109259,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110693,7 +109285,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110706,7 +109298,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110732,7 +109324,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110745,7 +109337,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110771,7 +109363,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110784,7 +109376,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110810,7 +109402,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110823,7 +109415,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110849,7 +109441,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110862,7 +109454,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110888,7 +109480,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110901,7 +109493,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110927,7 +109519,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110940,7 +109532,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -110966,7 +109558,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -110979,7 +109571,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111005,7 +109597,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111018,7 +109610,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111044,7 +109636,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111057,7 +109649,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111083,7 +109675,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111096,7 +109688,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111122,7 +109714,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111135,7 +109727,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111161,7 +109753,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111174,7 +109766,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111200,7 +109792,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111213,7 +109805,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111239,7 +109831,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111252,7 +109844,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111278,7 +109870,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111291,7 +109883,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111317,7 +109909,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111330,7 +109922,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111356,7 +109948,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111369,7 +109961,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111395,7 +109987,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111408,7 +110000,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111434,7 +110026,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111447,7 +110039,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111473,7 +110065,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111486,7 +110078,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111512,7 +110104,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111525,7 +110117,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111551,7 +110143,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111564,7 +110156,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111590,7 +110182,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111603,7 +110195,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111629,7 +110221,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111642,7 +110234,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111668,7 +110260,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111681,7 +110273,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111707,7 +110299,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111720,7 +110312,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111746,7 +110338,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111759,7 +110351,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111785,7 +110377,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111798,7 +110390,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111824,7 +110416,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111837,7 +110429,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111863,7 +110455,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111876,7 +110468,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111902,7 +110494,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111915,7 +110507,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111941,7 +110533,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111954,7 +110546,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -111980,7 +110572,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -111993,7 +110585,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112019,7 +110611,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112032,7 +110624,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112058,7 +110650,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112071,7 +110663,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112097,7 +110689,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112110,7 +110702,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112136,7 +110728,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112149,7 +110741,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112175,7 +110767,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112188,7 +110780,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112214,7 +110806,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112227,7 +110819,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112253,7 +110845,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112266,7 +110858,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112292,7 +110884,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112305,7 +110897,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112331,7 +110923,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112344,7 +110936,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112370,7 +110962,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112383,7 +110975,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112409,7 +111001,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112422,7 +111014,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112448,7 +111040,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112461,7 +111053,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112487,7 +111079,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112500,7 +111092,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112526,7 +111118,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112539,7 +111131,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112565,7 +111157,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112578,7 +111170,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112604,7 +111196,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112617,7 +111209,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112643,7 +111235,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112656,7 +111248,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112682,7 +111274,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112695,7 +111287,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112721,7 +111313,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112734,7 +111326,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112760,7 +111352,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112773,7 +111365,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112799,7 +111391,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112812,7 +111404,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112838,7 +111430,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112851,7 +111443,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112877,7 +111469,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112890,7 +111482,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112916,7 +111508,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112929,7 +111521,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112955,7 +111547,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -112968,7 +111560,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -112994,7 +111586,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113007,7 +111599,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113033,7 +111625,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113046,7 +111638,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113072,7 +111664,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113085,7 +111677,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113111,7 +111703,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113124,7 +111716,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113150,7 +111742,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113163,7 +111755,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113189,7 +111781,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113202,7 +111794,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113228,7 +111820,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113241,7 +111833,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113267,7 +111859,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113280,7 +111872,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113306,7 +111898,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113319,7 +111911,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113345,7 +111937,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113358,7 +111950,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113384,7 +111976,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113397,7 +111989,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113423,7 +112015,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113436,7 +112028,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113462,7 +112054,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113475,7 +112067,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113501,7 +112093,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113514,7 +112106,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113540,7 +112132,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113553,7 +112145,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113579,7 +112171,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113592,7 +112184,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113618,7 +112210,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113631,7 +112223,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113657,7 +112249,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113670,7 +112262,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113696,7 +112288,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113709,7 +112301,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113735,7 +112327,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113748,7 +112340,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113774,7 +112366,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113787,7 +112379,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113813,7 +112405,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113826,7 +112418,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113852,7 +112444,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113865,7 +112457,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113891,7 +112483,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113904,7 +112496,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113930,7 +112522,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113943,7 +112535,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -113969,7 +112561,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -113982,7 +112574,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114008,7 +112600,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114021,7 +112613,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114047,7 +112639,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114060,7 +112652,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114086,7 +112678,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114099,7 +112691,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114125,7 +112717,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114138,7 +112730,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114164,7 +112756,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114177,7 +112769,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114203,7 +112795,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114216,7 +112808,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114242,7 +112834,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114255,7 +112847,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114281,7 +112873,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114294,7 +112886,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114320,7 +112912,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114333,7 +112925,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114359,7 +112951,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114372,7 +112964,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114398,7 +112990,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114411,7 +113003,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114437,7 +113029,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114450,7 +113042,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114476,7 +113068,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114489,7 +113081,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114515,7 +113107,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114528,7 +113120,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114554,7 +113146,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114567,7 +113159,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114593,7 +113185,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114606,7 +113198,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114632,7 +113224,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114645,7 +113237,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114671,7 +113263,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114684,7 +113276,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114710,7 +113302,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114723,7 +113315,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114749,7 +113341,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114762,7 +113354,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114788,7 +113380,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114801,7 +113393,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114827,7 +113419,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114840,7 +113432,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114866,7 +113458,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114879,7 +113471,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114905,7 +113497,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114918,7 +113510,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114944,7 +113536,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114957,7 +113549,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -114983,7 +113575,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -114996,7 +113588,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115022,7 +113614,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115035,7 +113627,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115061,7 +113653,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115074,7 +113666,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115100,7 +113692,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115113,7 +113705,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115139,7 +113731,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115152,7 +113744,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115178,7 +113770,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115191,7 +113783,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115217,7 +113809,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115230,7 +113822,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115256,7 +113848,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115269,7 +113861,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115295,7 +113887,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115308,7 +113900,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115334,7 +113926,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115347,7 +113939,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115373,7 +113965,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115386,7 +113978,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115412,7 +114004,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115425,7 +114017,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115451,7 +114043,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115464,7 +114056,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115490,7 +114082,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115503,7 +114095,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115529,7 +114121,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115542,7 +114134,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115568,7 +114160,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115581,7 +114173,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115607,7 +114199,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115620,7 +114212,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115646,7 +114238,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115659,7 +114251,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115685,7 +114277,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115698,7 +114290,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115724,7 +114316,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115737,7 +114329,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115763,7 +114355,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115776,7 +114368,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115802,7 +114394,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115815,7 +114407,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115841,7 +114433,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115854,7 +114446,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115880,7 +114472,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115893,7 +114485,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115919,7 +114511,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115932,7 +114524,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115958,7 +114550,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -115971,7 +114563,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -115997,7 +114589,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116010,7 +114602,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116036,7 +114628,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116049,7 +114641,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116075,7 +114667,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116088,7 +114680,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116114,7 +114706,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116127,7 +114719,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116153,7 +114745,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116166,7 +114758,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116192,7 +114784,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116205,7 +114797,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116231,7 +114823,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116244,7 +114836,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116270,7 +114862,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116283,7 +114875,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116309,7 +114901,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116322,7 +114914,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116348,7 +114940,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116361,7 +114953,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116387,7 +114979,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116400,7 +114992,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116426,7 +115018,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116439,7 +115031,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116465,7 +115057,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116478,7 +115070,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116504,7 +115096,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116517,7 +115109,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116543,7 +115135,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116556,7 +115148,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116582,7 +115174,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116595,7 +115187,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116621,7 +115213,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116634,7 +115226,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116660,7 +115252,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116673,7 +115265,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116699,7 +115291,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116712,7 +115304,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116738,7 +115330,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116751,7 +115343,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116777,7 +115369,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116790,7 +115382,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116816,7 +115408,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116829,7 +115421,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116855,7 +115447,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116868,7 +115460,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116894,7 +115486,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116907,7 +115499,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116933,7 +115525,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116946,7 +115538,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -116972,7 +115564,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -116985,7 +115577,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117011,7 +115603,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117024,7 +115616,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117050,7 +115642,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117063,7 +115655,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117089,7 +115681,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117102,7 +115694,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117128,7 +115720,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117141,7 +115733,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117167,7 +115759,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117180,7 +115772,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117206,7 +115798,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117219,7 +115811,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117245,7 +115837,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117258,7 +115850,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117284,7 +115876,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117297,7 +115889,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117323,7 +115915,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117336,7 +115928,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117362,7 +115954,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117375,7 +115967,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117401,7 +115993,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117414,7 +116006,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117440,7 +116032,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117453,7 +116045,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117479,7 +116071,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117492,7 +116084,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117518,7 +116110,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117531,7 +116123,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117557,7 +116149,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117570,7 +116162,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117596,7 +116188,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117609,7 +116201,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117635,7 +116227,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117648,7 +116240,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117674,7 +116266,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117687,7 +116279,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117713,7 +116305,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117726,7 +116318,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117752,7 +116344,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117765,7 +116357,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117791,7 +116383,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117804,7 +116396,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117830,7 +116422,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117843,7 +116435,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117869,7 +116461,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117882,7 +116474,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117908,7 +116500,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117921,7 +116513,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117947,7 +116539,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117960,7 +116552,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -117986,7 +116578,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -117999,7 +116591,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118025,7 +116617,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118038,7 +116630,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118064,7 +116656,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118077,7 +116669,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118103,7 +116695,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118116,7 +116708,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118142,7 +116734,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118155,7 +116747,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118181,7 +116773,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118194,7 +116786,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118220,7 +116812,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118233,7 +116825,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118259,7 +116851,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118272,7 +116864,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118298,7 +116890,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118311,7 +116903,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118337,7 +116929,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118350,7 +116942,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118376,7 +116968,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118389,7 +116981,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118415,7 +117007,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118428,7 +117020,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118454,7 +117046,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118467,7 +117059,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118493,7 +117085,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118506,7 +117098,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118532,7 +117124,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118545,7 +117137,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118571,7 +117163,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118584,7 +117176,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118610,7 +117202,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118623,7 +117215,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118649,7 +117241,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118662,7 +117254,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118688,7 +117280,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118701,7 +117293,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118727,7 +117319,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118740,7 +117332,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118766,7 +117358,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118779,7 +117371,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118805,7 +117397,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118818,7 +117410,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118844,7 +117436,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118857,7 +117449,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118883,7 +117475,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118896,7 +117488,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118922,7 +117514,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118935,7 +117527,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -118961,7 +117553,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -118974,7 +117566,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119000,7 +117592,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119013,7 +117605,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119039,7 +117631,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119052,7 +117644,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119078,7 +117670,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119091,7 +117683,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119117,7 +117709,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119130,7 +117722,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119156,7 +117748,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119169,7 +117761,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119195,7 +117787,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119208,7 +117800,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119234,7 +117826,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119247,7 +117839,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119273,7 +117865,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119286,7 +117878,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119312,7 +117904,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119325,7 +117917,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119351,7 +117943,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119364,7 +117956,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119390,7 +117982,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119403,7 +117995,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119429,7 +118021,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119442,7 +118034,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119468,7 +118060,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119481,7 +118073,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119507,7 +118099,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119520,7 +118112,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119546,7 +118138,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119559,7 +118151,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119585,7 +118177,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119598,7 +118190,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119624,7 +118216,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119637,7 +118229,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119663,7 +118255,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119676,7 +118268,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119702,7 +118294,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119715,7 +118307,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119741,7 +118333,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119754,7 +118346,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119780,7 +118372,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119793,7 +118385,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119819,7 +118411,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119832,7 +118424,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119858,7 +118450,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119871,7 +118463,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119897,7 +118489,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119910,7 +118502,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119936,7 +118528,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119949,7 +118541,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -119975,7 +118567,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -119988,7 +118580,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120014,7 +118606,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120027,7 +118619,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120053,7 +118645,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120066,7 +118658,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120092,7 +118684,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120105,7 +118697,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120131,7 +118723,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120144,7 +118736,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120170,7 +118762,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120183,7 +118775,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120209,7 +118801,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120222,7 +118814,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120248,7 +118840,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120261,7 +118853,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120287,7 +118879,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120300,7 +118892,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120326,7 +118918,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120339,7 +118931,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120365,7 +118957,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120378,7 +118970,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120404,7 +118996,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120417,7 +119009,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120443,7 +119035,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120456,7 +119048,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120482,7 +119074,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120495,7 +119087,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120521,7 +119113,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120534,7 +119126,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120560,7 +119152,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120573,7 +119165,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120599,7 +119191,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120612,7 +119204,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120638,7 +119230,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120651,7 +119243,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120677,7 +119269,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120690,7 +119282,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120716,7 +119308,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120729,7 +119321,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120755,7 +119347,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120768,7 +119360,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120794,7 +119386,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120807,7 +119399,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120833,7 +119425,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120846,7 +119438,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120872,7 +119464,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120885,7 +119477,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120911,7 +119503,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120924,7 +119516,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120950,7 +119542,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -120963,7 +119555,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -120989,7 +119581,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121002,7 +119594,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121028,7 +119620,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121041,7 +119633,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121067,7 +119659,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121080,7 +119672,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121106,7 +119698,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121119,7 +119711,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121145,7 +119737,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121158,7 +119750,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121184,7 +119776,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121197,7 +119789,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121223,7 +119815,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121236,7 +119828,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121262,7 +119854,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121275,7 +119867,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121301,7 +119893,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121314,7 +119906,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121340,7 +119932,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121353,7 +119945,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121379,7 +119971,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121392,7 +119984,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121418,7 +120010,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121431,7 +120023,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121457,7 +120049,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121470,7 +120062,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121496,7 +120088,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121509,7 +120101,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121535,7 +120127,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121548,7 +120140,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121574,7 +120166,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121587,7 +120179,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121613,7 +120205,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121626,7 +120218,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121652,7 +120244,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121665,7 +120257,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121691,7 +120283,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121704,7 +120296,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121730,7 +120322,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121743,7 +120335,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121769,7 +120361,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121782,7 +120374,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121808,7 +120400,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121821,7 +120413,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121847,7 +120439,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121860,7 +120452,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121886,7 +120478,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121899,7 +120491,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121925,7 +120517,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121938,7 +120530,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -121964,7 +120556,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -121977,7 +120569,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122003,7 +120595,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122016,7 +120608,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122042,7 +120634,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122055,7 +120647,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122081,7 +120673,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122094,7 +120686,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122120,7 +120712,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122133,7 +120725,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122159,7 +120751,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122172,7 +120764,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122198,7 +120790,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122211,7 +120803,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122237,7 +120829,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122250,7 +120842,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122276,7 +120868,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122289,7 +120881,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122315,7 +120907,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122328,7 +120920,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122354,7 +120946,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122367,7 +120959,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122393,7 +120985,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122406,7 +120998,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122432,7 +121024,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122445,7 +121037,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122471,7 +121063,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122484,7 +121076,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122510,7 +121102,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122523,7 +121115,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122549,7 +121141,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122562,7 +121154,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122588,7 +121180,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122601,7 +121193,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122627,7 +121219,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122640,7 +121232,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122666,7 +121258,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122679,7 +121271,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122705,7 +121297,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122718,7 +121310,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122744,7 +121336,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122757,7 +121349,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122783,7 +121375,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122796,7 +121388,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122822,7 +121414,7 @@ T1110.003,No,-,4 T1003.005,No,-,4 T1036.002,No,-,4 T1568,No,-,4 -T1071.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml,3 +T1071.002,No,-,4 T1001,No,-,4 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,1 T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,1 @@ -122835,7 +121427,7 @@ T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-2 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-2 T1570,No,-,4 -T1095,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml,3 +T1095,No,-,4 T1496,No,-,4 T1213,No,-,4 T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,3 @@ -122882,10 +121474,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -122927,10 +121516,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -122972,10 +121558,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123017,10 +121600,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123062,10 +121642,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123107,10 +121684,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123152,10 +121726,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123197,10 +121768,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123242,10 +121810,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123287,10 +121852,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123332,10 +121894,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123377,10 +121936,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123422,10 +121978,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123467,10 +122020,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123512,10 +122062,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123557,10 +122104,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123602,10 +122146,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123647,10 +122188,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123692,10 +122230,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123737,10 +122272,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123782,10 +122314,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123827,10 +122356,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123872,10 +122398,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123917,10 +122440,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -123962,10 +122482,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124007,10 +122524,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124052,10 +122566,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124097,10 +122608,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124142,10 +122650,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124187,10 +122692,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124232,10 +122734,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124277,10 +122776,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124322,10 +122818,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124367,10 +122860,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124412,10 +122902,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124457,10 +122944,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124502,10 +122986,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124547,10 +123028,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124592,10 +123070,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124637,10 +123112,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124682,10 +123154,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124727,10 +123196,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124772,10 +123238,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124817,10 +123280,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124862,10 +123322,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124907,10 +123364,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124952,10 +123406,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -124997,10 +123448,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125042,10 +123490,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125087,10 +123532,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125132,10 +123574,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125177,10 +123616,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125222,10 +123658,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125267,10 +123700,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125312,10 +123742,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125357,10 +123784,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125402,10 +123826,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125447,10 +123868,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125492,10 +123910,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125537,10 +123952,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125582,10 +123994,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125627,10 +124036,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125672,10 +124078,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125717,10 +124120,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125762,10 +124162,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125807,10 +124204,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125852,10 +124246,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125897,10 +124288,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125942,10 +124330,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -125987,10 +124372,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126032,10 +124414,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126077,10 +124456,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126122,10 +124498,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126167,10 +124540,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126212,10 +124582,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126257,10 +124624,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126302,10 +124666,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126347,10 +124708,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126392,10 +124750,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126437,10 +124792,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126482,10 +124834,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126527,10 +124876,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126572,10 +124918,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126617,10 +124960,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126662,10 +125002,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126707,10 +125044,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126752,10 +125086,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126797,10 +125128,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126842,10 +125170,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126887,10 +125212,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126932,10 +125254,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -126977,10 +125296,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127022,10 +125338,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127067,10 +125380,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127112,10 +125422,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127157,10 +125464,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127202,10 +125506,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127247,10 +125548,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127292,10 +125590,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127337,10 +125632,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127382,10 +125674,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127427,10 +125716,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127472,10 +125758,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127517,10 +125800,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127562,10 +125842,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127607,10 +125884,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127652,10 +125926,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127697,10 +125968,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127742,10 +126010,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127787,10 +126052,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127832,10 +126094,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127877,10 +126136,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127922,10 +126178,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -127967,10 +126220,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128012,10 +126262,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128057,10 +126304,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128102,10 +126346,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128147,10 +126388,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128192,10 +126430,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128237,10 +126472,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128282,10 +126514,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128327,10 +126556,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128372,10 +126598,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128417,10 +126640,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128462,10 +126682,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128507,10 +126724,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128552,10 +126766,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128597,10 +126808,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128642,10 +126850,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128687,10 +126892,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128732,10 +126934,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128777,10 +126976,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128822,10 +127018,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128867,10 +127060,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128912,10 +127102,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -128957,10 +127144,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129002,10 +127186,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129047,10 +127228,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129092,10 +127270,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129137,10 +127312,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129182,10 +127354,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129227,10 +127396,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129272,10 +127438,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129317,10 +127480,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129362,10 +127522,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129407,10 +127564,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129452,10 +127606,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129497,10 +127648,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129542,10 +127690,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129587,10 +127732,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129632,10 +127774,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129677,10 +127816,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129722,10 +127858,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129767,10 +127900,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129812,10 +127942,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129857,10 +127984,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129902,10 +128026,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129947,10 +128068,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -129992,10 +128110,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130037,10 +128152,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130082,10 +128194,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130127,10 +128236,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130172,10 +128278,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130217,10 +128320,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130262,10 +128362,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130307,10 +128404,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130352,10 +128446,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130397,10 +128488,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130442,10 +128530,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130487,10 +128572,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130532,10 +128614,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130577,10 +128656,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130622,10 +128698,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130667,10 +128740,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130712,10 +128782,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130757,10 +128824,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130802,10 +128866,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130847,10 +128908,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130892,10 +128950,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130937,10 +128992,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -130982,10 +129034,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131027,10 +129076,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131072,10 +129118,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131117,10 +129160,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131162,10 +129202,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131207,10 +129244,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131252,10 +129286,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131297,10 +129328,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131342,10 +129370,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131387,10 +129412,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131432,10 +129454,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131477,10 +129496,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131522,10 +129538,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131567,10 +129580,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131612,10 +129622,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131657,10 +129664,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131702,10 +129706,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131747,10 +129748,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131792,10 +129790,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131837,10 +129832,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131882,10 +129874,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131927,10 +129916,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -131972,10 +129958,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132017,10 +130000,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132062,10 +130042,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132107,10 +130084,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132152,10 +130126,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132197,10 +130168,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132242,10 +130210,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132287,10 +130252,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132332,10 +130294,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132377,10 +130336,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132422,10 +130378,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132467,10 +130420,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132512,10 +130462,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132557,10 +130504,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132602,10 +130546,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132647,10 +130588,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132692,10 +130630,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132737,10 +130672,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132782,10 +130714,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132827,10 +130756,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132872,10 +130798,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132917,10 +130840,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -132962,10 +130882,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133007,10 +130924,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133052,10 +130966,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133097,10 +131008,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133142,10 +131050,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133187,10 +131092,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133232,10 +131134,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133277,10 +131176,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133322,10 +131218,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133367,10 +131260,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133412,10 +131302,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133457,10 +131344,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133502,10 +131386,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133547,10 +131428,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133592,10 +131470,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133637,10 +131512,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133682,10 +131554,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133727,10 +131596,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133772,10 +131638,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133817,10 +131680,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133862,10 +131722,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133907,10 +131764,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133952,10 +131806,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -133997,10 +131848,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134042,10 +131890,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134087,10 +131932,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134132,10 +131974,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134177,10 +132016,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134222,10 +132058,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134267,10 +132100,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134312,10 +132142,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134357,10 +132184,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134402,10 +132226,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134447,10 +132268,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134492,10 +132310,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134537,10 +132352,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134582,10 +132394,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134627,10 +132436,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134672,10 +132478,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134717,10 +132520,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134762,10 +132562,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134807,10 +132604,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134852,10 +132646,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134897,10 +132688,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134942,10 +132730,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -134987,10 +132772,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135032,10 +132814,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135077,10 +132856,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135122,10 +132898,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135167,10 +132940,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135212,10 +132982,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135257,10 +133024,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135302,10 +133066,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135347,10 +133108,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135392,10 +133150,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135437,10 +133192,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135482,10 +133234,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135527,10 +133276,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135572,10 +133318,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135617,10 +133360,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135662,10 +133402,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135707,10 +133444,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135752,10 +133486,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135797,10 +133528,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135842,10 +133570,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135887,10 +133612,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135932,10 +133654,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -135977,10 +133696,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136022,10 +133738,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136067,10 +133780,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136112,10 +133822,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136157,10 +133864,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136202,10 +133906,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136247,10 +133948,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136292,10 +133990,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136337,10 +134032,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136382,10 +134074,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136427,10 +134116,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136472,10 +134158,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136517,10 +134200,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136562,10 +134242,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136607,10 +134284,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136652,10 +134326,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136697,10 +134368,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136742,10 +134410,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136787,10 +134452,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136832,10 +134494,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136877,10 +134536,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136922,10 +134578,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -136967,10 +134620,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137012,10 +134662,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137057,10 +134704,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137102,10 +134746,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137147,10 +134788,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137192,10 +134830,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137237,10 +134872,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137282,10 +134914,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137327,10 +134956,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137372,10 +134998,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137417,10 +135040,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137462,10 +135082,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137507,10 +135124,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137552,10 +135166,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137597,10 +135208,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137642,10 +135250,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137687,10 +135292,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137732,10 +135334,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137777,10 +135376,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137822,10 +135418,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137867,10 +135460,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137912,10 +135502,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -137957,10 +135544,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -138002,10 +135586,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -138047,10 +135628,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -138092,10 +135670,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -138137,10 +135712,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -138182,10 +135754,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -138227,10 +135796,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -138272,10 +135838,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -138317,10 +135880,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -138362,10 +135922,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -138407,10 +135964,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -138452,10 +136006,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -138497,10 +136048,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -138542,10 +136090,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -138587,10 +136132,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -138632,10 +136174,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -138677,10 +136216,7 @@ T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,1 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-1 -T1498,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-1 +T1498,No,-,3 T1588.003,No,-,3 T1008,No,-,3 T1053.002,No,-,3 @@ -138695,7 +136231,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -138740,7 +136276,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -138785,7 +136321,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -138830,7 +136366,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -138875,7 +136411,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -138920,7 +136456,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -138965,7 +136501,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139010,7 +136546,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139055,7 +136591,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139100,7 +136636,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139145,7 +136681,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139190,7 +136726,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139235,7 +136771,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139280,7 +136816,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139325,7 +136861,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139370,7 +136906,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139415,7 +136951,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139460,7 +136996,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139505,7 +137041,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139550,7 +137086,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139595,7 +137131,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139640,7 +137176,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139685,7 +137221,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139730,7 +137266,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139775,7 +137311,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139820,7 +137356,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139865,7 +137401,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139910,7 +137446,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -139955,7 +137491,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140000,7 +137536,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140045,7 +137581,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140090,7 +137626,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140135,7 +137671,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140180,7 +137716,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140225,7 +137761,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140270,7 +137806,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140315,7 +137851,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140360,7 +137896,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140405,7 +137941,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140450,7 +137986,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140495,7 +138031,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140540,7 +138076,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140585,7 +138121,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140630,7 +138166,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140675,7 +138211,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140720,7 +138256,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140765,7 +138301,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140810,7 +138346,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140855,7 +138391,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140900,7 +138436,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140945,7 +138481,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -140990,7 +138526,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141035,7 +138571,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141080,7 +138616,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141125,7 +138661,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141170,7 +138706,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141215,7 +138751,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141260,7 +138796,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141305,7 +138841,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141350,7 +138886,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141395,7 +138931,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141440,7 +138976,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141485,7 +139021,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141530,7 +139066,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141575,7 +139111,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141620,7 +139156,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141665,7 +139201,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141710,7 +139246,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141755,7 +139291,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141800,7 +139336,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141845,7 +139381,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141890,7 +139426,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141935,7 +139471,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -141980,7 +139516,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142025,7 +139561,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142070,7 +139606,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142115,7 +139651,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142160,7 +139696,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142205,7 +139741,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142250,7 +139786,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142295,7 +139831,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142340,7 +139876,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142385,7 +139921,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142430,7 +139966,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142475,7 +140011,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142520,7 +140056,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142565,7 +140101,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142610,7 +140146,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142655,7 +140191,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142700,7 +140236,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142745,7 +140281,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142790,7 +140326,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142835,7 +140371,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142880,7 +140416,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142925,7 +140461,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -142970,7 +140506,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143015,7 +140551,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143060,7 +140596,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143105,7 +140641,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143150,7 +140686,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143195,7 +140731,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143240,7 +140776,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143285,7 +140821,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143330,7 +140866,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143375,7 +140911,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143420,7 +140956,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143465,7 +141001,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143510,7 +141046,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143555,7 +141091,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143600,7 +141136,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143645,7 +141181,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143690,7 +141226,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143735,7 +141271,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143780,7 +141316,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143825,7 +141361,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143870,7 +141406,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143915,7 +141451,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -143960,7 +141496,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144005,7 +141541,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144050,7 +141586,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144095,7 +141631,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144140,7 +141676,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144185,7 +141721,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144230,7 +141766,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144275,7 +141811,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144320,7 +141856,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144365,7 +141901,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144410,7 +141946,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144455,7 +141991,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144500,7 +142036,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144545,7 +142081,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144590,7 +142126,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144635,7 +142171,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144680,7 +142216,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144725,7 +142261,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144770,7 +142306,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144815,7 +142351,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144860,7 +142396,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144905,7 +142441,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144950,7 +142486,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -144995,7 +142531,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145040,7 +142576,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145085,7 +142621,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145130,7 +142666,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145175,7 +142711,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145220,7 +142756,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145265,7 +142801,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145310,7 +142846,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145355,7 +142891,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145400,7 +142936,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145445,7 +142981,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145490,7 +143026,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145535,7 +143071,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145580,7 +143116,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145625,7 +143161,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145670,7 +143206,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145715,7 +143251,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145760,7 +143296,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145805,7 +143341,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145850,7 +143386,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145895,7 +143431,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145940,7 +143476,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -145985,7 +143521,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146030,7 +143566,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146075,7 +143611,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146120,7 +143656,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146165,7 +143701,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146210,7 +143746,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146255,7 +143791,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146300,7 +143836,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146345,7 +143881,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146390,7 +143926,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146435,7 +143971,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146480,7 +144016,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146525,7 +144061,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146570,7 +144106,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146615,7 +144151,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146660,7 +144196,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146705,7 +144241,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146750,7 +144286,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146795,7 +144331,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146840,7 +144376,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146885,7 +144421,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146930,7 +144466,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -146975,7 +144511,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147020,7 +144556,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147065,7 +144601,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147110,7 +144646,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147155,7 +144691,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147200,7 +144736,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147245,7 +144781,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147290,7 +144826,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147335,7 +144871,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147380,7 +144916,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147425,7 +144961,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147470,7 +145006,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147515,7 +145051,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147560,7 +145096,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147605,7 +145141,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147650,7 +145186,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147695,7 +145231,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147740,7 +145276,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147785,7 +145321,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147830,7 +145366,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147875,7 +145411,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147920,7 +145456,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -147965,7 +145501,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148010,7 +145546,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148055,7 +145591,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148100,7 +145636,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148145,7 +145681,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148190,7 +145726,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148235,7 +145771,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148280,7 +145816,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148325,7 +145861,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148370,7 +145906,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148415,7 +145951,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148460,7 +145996,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148505,7 +146041,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148550,7 +146086,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148595,7 +146131,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148640,7 +146176,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148685,7 +146221,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148730,7 +146266,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148775,7 +146311,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148820,7 +146356,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148865,7 +146401,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148910,7 +146446,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -148955,7 +146491,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149000,7 +146536,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149045,7 +146581,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149090,7 +146626,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149135,7 +146671,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149180,7 +146716,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149225,7 +146761,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149270,7 +146806,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149315,7 +146851,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149360,7 +146896,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149405,7 +146941,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149450,7 +146986,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149495,7 +147031,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149540,7 +147076,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149585,7 +147121,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149630,7 +147166,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149675,7 +147211,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149720,7 +147256,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149765,7 +147301,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149810,7 +147346,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149855,7 +147391,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149900,7 +147436,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149945,7 +147481,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -149990,7 +147526,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150035,7 +147571,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150080,7 +147616,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150125,7 +147661,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150170,7 +147706,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150215,7 +147751,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150260,7 +147796,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150305,7 +147841,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150350,7 +147886,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150395,7 +147931,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150440,7 +147976,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150485,7 +148021,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150530,7 +148066,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150575,7 +148111,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150620,7 +148156,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150665,7 +148201,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150710,7 +148246,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150755,7 +148291,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150800,7 +148336,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150845,7 +148381,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150890,7 +148426,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150935,7 +148471,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -150980,7 +148516,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151025,7 +148561,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151070,7 +148606,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151115,7 +148651,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151160,7 +148696,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151205,7 +148741,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151250,7 +148786,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151295,7 +148831,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151340,7 +148876,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151385,7 +148921,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151430,7 +148966,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151475,7 +149011,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151520,7 +149056,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151565,7 +149101,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151610,7 +149146,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151655,7 +149191,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151700,7 +149236,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151745,7 +149281,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151790,7 +149326,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151835,7 +149371,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151880,7 +149416,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151925,7 +149461,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -151970,7 +149506,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152015,7 +149551,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152060,7 +149596,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152105,7 +149641,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152150,7 +149686,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152195,7 +149731,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152240,7 +149776,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152285,7 +149821,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152330,7 +149866,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152375,7 +149911,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152420,7 +149956,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152465,7 +150001,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152510,7 +150046,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152555,7 +150091,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152600,7 +150136,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152645,7 +150181,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152690,7 +150226,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152735,7 +150271,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152780,7 +150316,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152825,7 +150361,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152870,7 +150406,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152915,7 +150451,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -152960,7 +150496,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153005,7 +150541,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153050,7 +150586,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153095,7 +150631,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153140,7 +150676,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153185,7 +150721,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153230,7 +150766,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153275,7 +150811,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153320,7 +150856,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153365,7 +150901,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153410,7 +150946,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153455,7 +150991,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153500,7 +151036,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153545,7 +151081,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153590,7 +151126,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153635,7 +151171,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153680,7 +151216,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153725,7 +151261,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153770,7 +151306,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153815,7 +151351,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153860,7 +151396,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153905,7 +151441,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153950,7 +151486,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -153995,7 +151531,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -154040,7 +151576,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -154085,7 +151621,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -154130,7 +151666,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -154175,7 +151711,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -154220,7 +151756,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -154265,7 +151801,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -154310,7 +151846,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -154355,7 +151891,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -154400,7 +151936,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -154445,7 +151981,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -154490,7 +152026,7 @@ T1109,No,-,2 T1588.004,No,-,2 T1587.003,No,-,2 T1565.001,No,-,2 -T1114.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml,1 +T1114.001,No,-,2 T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1 T1568.001,No,-,2 T1559.001,No,-,2 @@ -154528,7 +152064,7 @@ T1480.001,No,-,2 T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,0 T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,0 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -154606,38 +152142,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -154648,7 +152178,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -154726,38 +152256,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -154768,7 +152292,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -154846,38 +152370,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -154888,7 +152406,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -154966,38 +152484,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -155008,7 +152520,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -155086,38 +152598,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -155128,7 +152634,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -155206,38 +152712,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -155248,7 +152748,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -155326,38 +152826,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -155368,7 +152862,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -155446,38 +152940,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -155488,7 +152976,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -155566,38 +153054,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -155608,7 +153090,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -155686,38 +153168,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -155728,7 +153204,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -155806,38 +153282,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -155848,7 +153318,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -155926,38 +153396,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -155968,7 +153432,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -156046,38 +153510,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -156088,7 +153546,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -156166,38 +153624,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -156208,7 +153660,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -156286,38 +153738,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -156328,7 +153774,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -156406,38 +153852,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -156448,7 +153888,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -156526,38 +153966,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -156568,7 +154002,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -156646,38 +154080,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -156688,7 +154116,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -156766,38 +154194,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -156808,7 +154230,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -156886,38 +154308,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -156928,7 +154344,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -157006,38 +154422,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -157048,7 +154458,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -157126,38 +154536,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -157168,7 +154572,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -157246,38 +154650,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -157288,7 +154686,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -157366,38 +154764,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -157408,7 +154800,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -157486,38 +154878,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -157528,7 +154914,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -157606,38 +154992,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -157648,7 +155028,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -157726,38 +155106,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -157768,7 +155142,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -157846,38 +155220,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -157888,7 +155256,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -157966,38 +155334,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -158008,7 +155370,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -158086,38 +155448,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -158128,7 +155484,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -158206,38 +155562,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -158248,7 +155598,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -158326,38 +155676,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -158368,7 +155712,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -158446,38 +155790,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -158488,7 +155826,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -158566,38 +155904,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -158608,7 +155940,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -158686,38 +156018,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -158728,7 +156054,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -158806,38 +156132,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -158848,7 +156168,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -158926,38 +156246,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -158968,7 +156282,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -159046,38 +156360,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -159088,7 +156396,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -159166,38 +156474,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -159208,7 +156510,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -159286,38 +156588,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -159328,7 +156624,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -159406,38 +156702,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -159448,7 +156738,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -159526,38 +156816,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -159568,7 +156852,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -159646,38 +156930,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -159688,7 +156966,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -159766,38 +157044,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -159808,7 +157080,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -159886,38 +157158,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -159928,7 +157194,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -160006,38 +157272,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -160048,7 +157308,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -160126,38 +157386,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -160168,7 +157422,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -160246,38 +157500,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -160288,7 +157536,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -160366,38 +157614,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -160408,7 +157650,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -160486,38 +157728,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -160528,7 +157764,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -160606,38 +157842,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -160648,7 +157878,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -160726,38 +157956,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -160768,7 +157992,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -160846,38 +158070,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -160888,7 +158106,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -160966,38 +158184,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -161008,7 +158220,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -161086,38 +158298,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -161128,7 +158334,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -161206,38 +158412,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -161248,7 +158448,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -161326,38 +158526,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -161368,7 +158562,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -161446,38 +158640,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -161488,7 +158676,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -161566,38 +158754,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -161608,7 +158790,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -161686,38 +158868,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -161728,7 +158904,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -161806,38 +158982,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -161848,7 +159018,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -161926,38 +159096,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -161968,7 +159132,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -162046,38 +159210,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -162088,7 +159246,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -162166,38 +159324,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -162208,7 +159360,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -162286,38 +159438,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -162328,7 +159474,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -162406,38 +159552,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -162448,7 +159588,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -162526,38 +159666,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -162568,7 +159702,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -162646,38 +159780,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -162688,7 +159816,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -162766,38 +159894,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -162808,7 +159930,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -162886,38 +160008,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -162928,7 +160044,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -163006,38 +160122,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -163048,7 +160158,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -163126,38 +160236,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -163168,7 +160272,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -163246,38 +160350,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -163288,7 +160386,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -163366,38 +160464,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -163408,7 +160500,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -163486,38 +160578,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -163528,7 +160614,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -163606,38 +160692,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -163648,7 +160728,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -163726,38 +160806,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -163768,7 +160842,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -163846,38 +160920,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -163888,7 +160956,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -163966,38 +161034,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -164008,7 +161070,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -164086,38 +161148,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -164128,7 +161184,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -164206,38 +161262,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -164248,7 +161298,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -164326,38 +161376,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -164368,7 +161412,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -164446,38 +161490,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -164488,7 +161526,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -164566,38 +161604,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -164608,7 +161640,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -164686,38 +161718,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -164728,7 +161754,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -164806,38 +161832,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -164848,7 +161868,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -164926,38 +161946,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -164968,7 +161982,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -165046,38 +162060,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -165088,7 +162096,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -165166,38 +162174,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -165208,7 +162210,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -165286,38 +162288,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -165328,7 +162324,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -165406,38 +162402,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -165448,7 +162438,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -165526,38 +162516,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -165568,7 +162552,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -165646,38 +162630,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -165688,7 +162666,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -165766,38 +162744,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -165808,7 +162780,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -165886,38 +162858,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -165928,7 +162894,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -166006,38 +162972,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -166048,7 +163008,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -166126,38 +163086,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -166168,7 +163122,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -166246,38 +163200,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -166288,7 +163236,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -166366,38 +163314,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -166408,7 +163350,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -166486,38 +163428,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -166528,7 +163464,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -166606,38 +163542,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -166648,7 +163578,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -166726,38 +163656,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -166768,7 +163692,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -166846,38 +163770,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -166888,7 +163806,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -166966,38 +163884,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -167008,7 +163920,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -167086,38 +163998,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -167128,7 +164034,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -167206,38 +164112,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -167248,7 +164148,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -167326,38 +164226,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -167368,7 +164262,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -167446,38 +164340,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -167488,7 +164376,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -167566,38 +164454,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -167608,7 +164490,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -167686,38 +164568,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -167728,7 +164604,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -167806,38 +164682,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -167848,7 +164718,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -167926,38 +164796,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -167968,7 +164832,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -168046,38 +164910,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -168088,7 +164946,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -168166,38 +165024,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -168208,7 +165060,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -168286,38 +165138,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -168328,7 +165174,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -168406,38 +165252,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -168448,7 +165288,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -168526,38 +165366,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -168568,7 +165402,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -168646,38 +165480,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -168688,7 +165516,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -168766,38 +165594,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -168808,7 +165630,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -168886,38 +165708,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -168928,7 +165744,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -169006,38 +165822,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -169048,7 +165858,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -169126,38 +165936,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -169168,7 +165972,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -169246,38 +166050,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -169288,7 +166086,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -169366,38 +166164,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -169408,7 +166200,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -169486,38 +166278,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -169528,7 +166314,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -169606,38 +166392,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -169648,7 +166428,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -169726,38 +166506,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -169768,7 +166542,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -169846,38 +166620,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -169888,7 +166656,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -169966,38 +166734,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -170008,7 +166770,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -170086,38 +166848,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -170128,7 +166884,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -170206,38 +166962,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -170248,7 +166998,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -170326,38 +167076,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -170368,7 +167112,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -170446,38 +167190,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -170488,7 +167226,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -170566,38 +167304,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -170608,7 +167340,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -170686,38 +167418,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -170728,7 +167454,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -170806,38 +167532,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -170848,7 +167568,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -170926,38 +167646,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -170968,7 +167682,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -171046,38 +167760,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -171088,7 +167796,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -171166,38 +167874,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -171208,7 +167910,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -171286,38 +167988,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -171328,7 +168024,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -171406,38 +168102,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -171448,7 +168138,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -171526,38 +168216,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -171568,7 +168252,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -171646,38 +168330,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -171688,7 +168366,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -171766,38 +168444,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -171808,7 +168480,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -171886,38 +168558,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -171928,7 +168594,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -172006,38 +168672,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -172048,7 +168708,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -172126,38 +168786,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -172168,7 +168822,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -172246,38 +168900,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -172288,7 +168936,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -172366,38 +169014,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -172408,7 +169050,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -172486,38 +169128,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -172528,7 +169164,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -172606,38 +169242,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -172648,7 +169278,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -172726,38 +169356,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -172768,7 +169392,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -172846,38 +169470,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -172888,7 +169506,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -172966,38 +169584,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -173008,7 +169620,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -173086,38 +169698,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -173128,7 +169734,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -173206,38 +169812,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -173248,7 +169848,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -173326,38 +169926,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -173368,7 +169962,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -173446,38 +170040,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -173488,7 +170076,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -173566,38 +170154,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -173608,7 +170190,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -173686,38 +170268,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -173728,7 +170304,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -173806,38 +170382,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -173848,7 +170418,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -173926,38 +170496,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -173968,7 +170532,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -174046,38 +170610,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -174088,7 +170646,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -174166,38 +170724,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -174208,7 +170760,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -174286,38 +170838,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -174328,7 +170874,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -174406,38 +170952,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -174448,7 +170988,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -174526,38 +171066,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -174568,7 +171102,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -174646,38 +171180,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -174688,7 +171216,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -174766,38 +171294,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -174808,7 +171330,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -174886,38 +171408,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -174928,7 +171444,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -175006,38 +171522,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -175048,7 +171558,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -175126,38 +171636,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -175168,7 +171672,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -175246,38 +171750,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -175288,7 +171786,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -175366,38 +171864,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -175408,7 +171900,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -175486,38 +171978,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -175528,7 +172014,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -175606,38 +172092,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -175648,7 +172128,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -175726,38 +172206,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -175768,7 +172242,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -175846,38 +172320,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -175888,7 +172356,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -175966,38 +172434,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -176008,7 +172470,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -176086,38 +172548,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -176128,7 +172584,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -176206,38 +172662,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -176248,7 +172698,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -176326,38 +172776,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -176368,7 +172812,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -176446,38 +172890,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -176488,7 +172926,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -176566,38 +173004,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -176608,7 +173040,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -176686,38 +173118,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -176728,7 +173154,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -176806,38 +173232,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -176848,7 +173268,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -176926,38 +173346,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -176968,7 +173382,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -177046,38 +173460,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -177088,7 +173496,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -177166,38 +173574,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -177208,7 +173610,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -177286,38 +173688,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -177328,7 +173724,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -177406,38 +173802,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -177448,7 +173838,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -177526,38 +173916,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -177568,7 +173952,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -177646,38 +174030,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -177688,7 +174066,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -177766,38 +174144,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -177808,7 +174180,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -177886,38 +174258,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -177928,7 +174294,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -178006,38 +174372,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -178048,7 +174408,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -178126,38 +174486,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -178168,7 +174522,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -178246,38 +174600,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -178288,7 +174636,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -178366,38 +174714,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -178408,7 +174750,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -178486,38 +174828,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -178528,7 +174864,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -178606,38 +174942,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -178648,7 +174978,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -178726,38 +175056,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -178768,7 +175092,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -178846,38 +175170,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -178888,7 +175206,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -178966,38 +175284,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -179008,7 +175320,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -179086,38 +175398,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -179128,7 +175434,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -179206,38 +175512,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -179248,7 +175548,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -179326,38 +175626,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -179368,7 +175662,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -179446,38 +175740,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -179488,7 +175776,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -179566,38 +175854,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -179608,7 +175890,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -179686,38 +175968,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -179728,7 +176004,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -179806,38 +176082,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -179848,7 +176118,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -179926,38 +176196,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -179968,7 +176232,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -180046,38 +176310,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -180088,7 +176346,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -180166,38 +176424,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -180208,7 +176460,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -180286,38 +176538,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -180328,7 +176574,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -180406,38 +176652,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -180448,7 +176688,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -180526,38 +176766,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -180568,7 +176802,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -180646,38 +176880,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -180688,7 +176916,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -180766,38 +176994,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -180808,7 +177030,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -180886,38 +177108,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -180928,7 +177144,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -181006,38 +177222,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -181048,7 +177258,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -181126,38 +177336,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -181168,7 +177372,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -181246,38 +177450,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -181288,7 +177486,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -181366,38 +177564,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -181408,7 +177600,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -181486,38 +177678,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -181528,7 +177714,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -181606,38 +177792,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -181648,7 +177828,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -181726,38 +177906,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -181768,7 +177942,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -181846,38 +178020,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -181888,7 +178056,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -181966,38 +178134,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -182008,7 +178170,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -182086,38 +178248,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -182128,7 +178284,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -182206,38 +178362,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -182248,7 +178398,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -182326,38 +178476,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -182368,7 +178512,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -182446,38 +178590,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -182488,7 +178626,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -182566,38 +178704,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -182608,7 +178740,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -182686,38 +178818,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -182728,7 +178854,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -182806,38 +178932,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -182848,7 +178968,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -182926,38 +179046,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -182968,7 +179082,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -183046,38 +179160,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -183088,7 +179196,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -183166,38 +179274,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -183208,7 +179310,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -183286,38 +179388,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -183328,7 +179424,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -183406,38 +179502,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -183448,7 +179538,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -183526,38 +179616,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -183568,7 +179652,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -183646,38 +179730,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -183688,7 +179766,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -183766,38 +179844,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -183808,7 +179880,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -183886,38 +179958,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -183928,7 +179994,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -184006,38 +180072,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -184048,7 +180108,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -184126,38 +180186,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -184168,7 +180222,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -184246,38 +180300,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -184288,7 +180336,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -184366,38 +180414,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -184408,7 +180450,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -184486,38 +180528,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -184528,7 +180564,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -184606,38 +180642,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -184648,7 +180678,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -184726,38 +180756,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -184768,7 +180792,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -184846,38 +180870,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -184888,7 +180906,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -184966,38 +180984,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -185008,7 +181020,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -185086,38 +181098,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -185128,7 +181134,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -185206,38 +181212,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -185248,7 +181248,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -185326,38 +181326,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -185368,7 +181362,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -185446,38 +181440,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -185488,7 +181476,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -185566,38 +181554,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -185608,7 +181590,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -185686,38 +181668,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -185728,7 +181704,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -185806,38 +181782,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -185848,7 +181818,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -185926,38 +181896,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -185968,7 +181932,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -186046,38 +182010,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -186088,7 +182046,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -186166,38 +182124,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -186208,7 +182160,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -186286,38 +182238,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -186328,7 +182274,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -186406,38 +182352,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -186448,7 +182388,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -186526,38 +182466,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -186568,7 +182502,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -186646,38 +182580,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -186688,7 +182616,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -186766,38 +182694,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -186808,7 +182730,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -186886,38 +182808,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -186928,7 +182844,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -187006,38 +182922,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -187048,7 +182958,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -187126,38 +183036,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -187168,7 +183072,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -187246,38 +183150,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -187288,7 +183186,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -187366,38 +183264,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -187408,7 +183300,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -187486,38 +183378,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -187528,7 +183414,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -187606,38 +183492,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -187648,7 +183528,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -187726,38 +183606,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -187768,7 +183642,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -187846,38 +183720,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -187888,7 +183756,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -187966,38 +183834,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -188008,7 +183870,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -188086,38 +183948,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -188128,7 +183984,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -188206,38 +184062,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -188248,7 +184098,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -188326,38 +184176,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -188368,7 +184212,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -188446,38 +184290,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -188488,7 +184326,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -188566,38 +184404,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -188608,7 +184440,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -188686,38 +184518,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -188728,7 +184554,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -188806,38 +184632,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -188848,7 +184668,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -188926,38 +184746,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -188968,7 +184782,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -189046,38 +184860,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -189088,7 +184896,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -189166,38 +184974,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -189208,7 +185010,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -189286,38 +185088,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -189328,7 +185124,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -189406,38 +185202,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -189448,7 +185238,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -189526,38 +185316,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -189568,7 +185352,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -189646,38 +185430,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -189688,7 +185466,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -189766,38 +185544,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -189808,7 +185580,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -189886,38 +185658,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -189928,7 +185694,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -190006,38 +185772,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -190048,7 +185808,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -190126,38 +185886,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -190168,7 +185922,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -190246,38 +186000,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -190288,7 +186036,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -190366,38 +186114,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -190408,7 +186150,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -190486,38 +186228,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -190528,7 +186264,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -190606,38 +186342,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -190648,7 +186378,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -190726,38 +186456,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -190768,7 +186492,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -190846,38 +186570,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -190888,7 +186606,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -190966,38 +186684,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -191008,7 +186720,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -191086,38 +186798,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -191128,7 +186834,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -191206,38 +186912,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -191248,7 +186948,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -191326,38 +187026,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -191368,7 +187062,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -191446,38 +187140,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -191488,7 +187176,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -191566,38 +187254,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -191608,7 +187290,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -191686,38 +187368,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -191728,7 +187404,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -191806,38 +187482,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -191848,7 +187518,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -191926,38 +187596,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -191968,7 +187632,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -192046,38 +187710,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -192088,7 +187746,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -192166,38 +187824,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -192208,7 +187860,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -192286,38 +187938,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -192328,7 +187974,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -192406,38 +188052,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -192448,7 +188088,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -192526,38 +188166,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -192568,7 +188202,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -192646,38 +188280,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -192688,7 +188316,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -192766,38 +188394,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -192808,7 +188430,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -192886,38 +188508,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -192928,7 +188544,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -193006,38 +188622,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -193048,7 +188658,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -193126,38 +188736,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -193168,7 +188772,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -193246,38 +188850,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -193288,7 +188886,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -193366,38 +188964,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -193408,7 +189000,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -193486,38 +189078,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -193528,7 +189114,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -193606,38 +189192,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -193648,7 +189228,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -193726,38 +189306,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -193768,7 +189342,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -193846,38 +189420,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -193888,7 +189456,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -193966,38 +189534,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -194008,7 +189570,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -194086,38 +189648,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -194128,7 +189684,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -194206,38 +189762,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -194248,7 +189798,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -194326,38 +189876,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -194368,7 +189912,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -194446,38 +189990,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -194488,7 +190026,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -194566,38 +190104,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -194608,7 +190140,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -194686,38 +190218,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -194728,7 +190254,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -194806,38 +190332,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -194848,7 +190368,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -194926,38 +190446,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -194968,7 +190482,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -195046,38 +190560,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -195088,7 +190596,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -195166,38 +190674,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -195208,7 +190710,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -195286,38 +190788,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -195328,7 +190824,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -195406,38 +190902,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -195448,7 +190938,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -195526,38 +191016,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -195568,7 +191052,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -195646,38 +191130,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -195688,7 +191166,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -195766,38 +191244,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -195808,7 +191280,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -195886,38 +191358,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -195928,7 +191394,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -196006,38 +191472,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -196048,7 +191508,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -196126,38 +191586,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -196168,7 +191622,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -196246,38 +191700,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -196288,7 +191736,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -196366,38 +191814,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -196408,7 +191850,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -196486,38 +191928,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -196528,7 +191964,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -196606,38 +192042,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 @@ -196648,7 +192078,7 @@ T1561.001,No,-,1 T1211,No,-,1 T1574.012,No,-,1 T1021.005,No,-,1 -T1110.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml,0 +T1110.001,No,-,1 T1216.001,No,-,1 T1546.013,No,-,1 T1501,No,-,1 @@ -196726,38 +192156,32 @@ T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2 T1494,No,-,1 T1090.004,No,-,1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-1 -T1557.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-1 +T1557.002,No,-,1 T1493,No,-,1 T1565.002,No,-,1 T1146,No,-,1 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml,-3 -T1200,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml,-3 +T1200,No,-,1 T1556.001,No,-,1 T1543.002,No,-,1 T1126,No,-,1 T1220,No,-,1 T1137.002,No,-,1 T1550.001,No,-,1 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16 -T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-14 +T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-14 T1564.004,No,-,1 T1096,No,-,1 T1003.006,No,-,1 diff --git a/docs/mitre-map/detections.json b/docs/mitre-map/detections.json index c9e73847ed..183d476228 100644 --- a/docs/mitre-map/detections.json +++ b/docs/mitre-map/detections.json @@ -21126,2115 +21126,2115 @@ }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1071.001", - "score": 33, + "score": 34, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/tor_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1107", @@ -26764,9 +26764,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -26776,9 +26776,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -26788,9 +26788,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -26800,9 +26800,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -26812,9 +26812,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -26824,9 +26824,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -26836,9 +26836,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -26848,9 +26848,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -26860,9 +26860,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -26872,9 +26872,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -26884,9 +26884,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -26896,9 +26896,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -26908,9 +26908,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -26920,9 +26920,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -26932,9 +26932,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -26944,9 +26944,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -26956,9 +26956,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -26968,9 +26968,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -26980,9 +26980,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -26992,9 +26992,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27004,9 +27004,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27016,9 +27016,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27028,9 +27028,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27040,9 +27040,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27052,9 +27052,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27064,9 +27064,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27076,9 +27076,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27088,9 +27088,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27100,9 +27100,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27112,9 +27112,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27124,9 +27124,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27136,9 +27136,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27148,9 +27148,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27160,9 +27160,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27172,9 +27172,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27184,9 +27184,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27196,9 +27196,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27208,9 +27208,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27220,9 +27220,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27232,9 +27232,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27244,9 +27244,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27256,9 +27256,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27268,9 +27268,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27280,9 +27280,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27292,9 +27292,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27304,9 +27304,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27316,9 +27316,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27328,9 +27328,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27340,9 +27340,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27352,9 +27352,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27364,9 +27364,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27376,9 +27376,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27388,9 +27388,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27400,9 +27400,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27412,9 +27412,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27424,9 +27424,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27436,9 +27436,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27448,9 +27448,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27460,9 +27460,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27472,9 +27472,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27484,9 +27484,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27496,9 +27496,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27508,9 +27508,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27520,9 +27520,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27532,9 +27532,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27544,9 +27544,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27556,9 +27556,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27568,9 +27568,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27580,9 +27580,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27592,9 +27592,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27604,9 +27604,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27616,9 +27616,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27628,9 +27628,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27640,9 +27640,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27652,9 +27652,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27664,9 +27664,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27676,9 +27676,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27688,9 +27688,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27700,9 +27700,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27712,9 +27712,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27724,9 +27724,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27736,9 +27736,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27748,9 +27748,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27760,9 +27760,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27772,9 +27772,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27784,9 +27784,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27796,9 +27796,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27808,9 +27808,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27820,9 +27820,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27832,9 +27832,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27844,9 +27844,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27856,9 +27856,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27868,9 +27868,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27880,9 +27880,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27892,9 +27892,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27904,9 +27904,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27916,9 +27916,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27928,9 +27928,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27940,9 +27940,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27952,9 +27952,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27964,9 +27964,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27976,9 +27976,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -27988,9 +27988,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28000,9 +28000,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28012,9 +28012,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28024,9 +28024,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28036,9 +28036,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28048,9 +28048,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28060,9 +28060,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28072,9 +28072,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28084,9 +28084,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28096,9 +28096,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28108,9 +28108,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28120,9 +28120,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28132,9 +28132,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28144,9 +28144,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28156,9 +28156,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28168,9 +28168,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28180,9 +28180,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28192,9 +28192,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28204,9 +28204,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28216,9 +28216,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28228,9 +28228,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28240,9 +28240,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28252,9 +28252,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28264,9 +28264,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28276,9 +28276,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28288,9 +28288,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28300,9 +28300,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28312,9 +28312,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28324,9 +28324,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28336,9 +28336,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28348,9 +28348,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28360,9 +28360,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28372,9 +28372,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28384,9 +28384,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28396,9 +28396,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28408,9 +28408,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28420,9 +28420,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28432,9 +28432,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28444,9 +28444,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28456,9 +28456,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28468,9 +28468,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28480,9 +28480,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28492,9 +28492,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28504,9 +28504,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28516,9 +28516,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28528,9 +28528,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28540,9 +28540,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28552,9 +28552,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28564,9 +28564,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28576,9 +28576,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28588,9 +28588,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28600,9 +28600,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28612,9 +28612,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28624,9 +28624,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28636,9 +28636,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28648,9 +28648,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28660,9 +28660,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28672,9 +28672,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28684,9 +28684,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28696,9 +28696,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28708,9 +28708,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28720,9 +28720,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28732,9 +28732,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28744,9 +28744,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28756,9 +28756,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28768,9 +28768,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28780,9 +28780,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28792,9 +28792,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28804,9 +28804,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28816,9 +28816,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28828,9 +28828,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28840,9 +28840,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28852,9 +28852,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28864,9 +28864,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28876,9 +28876,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28888,9 +28888,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28900,9 +28900,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28912,9 +28912,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28924,9 +28924,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28936,9 +28936,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28948,9 +28948,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28960,9 +28960,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28972,9 +28972,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28984,9 +28984,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -28996,9 +28996,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29008,9 +29008,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29020,9 +29020,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29032,9 +29032,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29044,9 +29044,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29056,9 +29056,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29068,9 +29068,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29080,9 +29080,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29092,9 +29092,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29104,9 +29104,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29116,9 +29116,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29128,9 +29128,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29140,9 +29140,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29152,9 +29152,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29164,9 +29164,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29176,9 +29176,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29188,9 +29188,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29200,9 +29200,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29212,9 +29212,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29224,9 +29224,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29236,9 +29236,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29248,9 +29248,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29260,9 +29260,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29272,9 +29272,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29284,9 +29284,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29296,9 +29296,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29308,9 +29308,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29320,9 +29320,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29332,9 +29332,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29344,9 +29344,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29356,9 +29356,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29368,9 +29368,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29380,9 +29380,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29392,9 +29392,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29404,9 +29404,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29416,9 +29416,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29428,9 +29428,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29440,9 +29440,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29452,9 +29452,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29464,9 +29464,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29476,9 +29476,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29488,9 +29488,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29500,9 +29500,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29512,9 +29512,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29524,9 +29524,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29536,9 +29536,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29548,9 +29548,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29560,9 +29560,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29572,9 +29572,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29584,9 +29584,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29596,9 +29596,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29608,9 +29608,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29620,9 +29620,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29632,9 +29632,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29644,9 +29644,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29656,9 +29656,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29668,9 +29668,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29680,9 +29680,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29692,9 +29692,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29704,9 +29704,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29716,9 +29716,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29728,9 +29728,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29740,9 +29740,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29752,9 +29752,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29764,9 +29764,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29776,9 +29776,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29788,9 +29788,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29800,9 +29800,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29812,9 +29812,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29824,9 +29824,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29836,9 +29836,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29848,9 +29848,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29860,9 +29860,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29872,9 +29872,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29884,9 +29884,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29896,9 +29896,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29908,9 +29908,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29920,9 +29920,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29932,9 +29932,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29944,9 +29944,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29956,9 +29956,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29968,9 +29968,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29980,9 +29980,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -29992,9 +29992,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30004,9 +30004,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30016,9 +30016,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30028,9 +30028,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30040,9 +30040,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30052,9 +30052,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30064,9 +30064,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30076,9 +30076,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30088,9 +30088,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30100,9 +30100,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30112,9 +30112,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30124,9 +30124,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30136,9 +30136,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30148,9 +30148,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30160,9 +30160,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30172,9 +30172,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30184,9 +30184,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30196,9 +30196,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30208,9 +30208,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30220,9 +30220,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30232,9 +30232,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30244,9 +30244,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30256,9 +30256,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30268,9 +30268,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30280,9 +30280,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30292,9 +30292,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30304,9 +30304,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30316,9 +30316,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30328,9 +30328,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30340,9 +30340,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30352,9 +30352,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30364,9 +30364,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30376,9 +30376,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30388,9 +30388,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30400,9 +30400,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30412,9 +30412,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30424,9 +30424,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30436,9 +30436,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30448,9 +30448,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30460,9 +30460,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30472,9 +30472,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30484,9 +30484,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30496,9 +30496,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30508,9 +30508,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30520,9 +30520,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30532,9 +30532,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30544,9 +30544,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30556,9 +30556,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30568,9 +30568,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30580,9 +30580,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30592,9 +30592,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30604,9 +30604,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30616,9 +30616,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30628,9 +30628,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30640,9 +30640,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30652,9 +30652,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30664,9 +30664,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30676,9 +30676,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30688,9 +30688,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30700,9 +30700,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30712,9 +30712,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30724,9 +30724,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30736,9 +30736,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30748,9 +30748,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30760,9 +30760,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30772,9 +30772,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30784,9 +30784,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30796,9 +30796,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30808,9 +30808,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30820,9 +30820,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30832,9 +30832,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30844,9 +30844,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30856,9 +30856,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30868,9 +30868,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30880,9 +30880,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30892,9 +30892,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30904,9 +30904,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30916,9 +30916,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30928,9 +30928,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30940,9 +30940,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30952,9 +30952,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30964,9 +30964,9 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1053.005", @@ -30976,21 +30976,21 @@ }, { "techniqueID": "T1078", - "score": 9, + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -30999,15 +30999,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31016,15 +31016,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31033,15 +31033,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31050,15 +31050,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31067,15 +31067,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31084,15 +31084,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31101,15 +31101,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31118,15 +31118,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31135,15 +31135,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31152,15 +31152,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31169,15 +31169,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31186,15 +31186,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31203,15 +31203,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31220,15 +31220,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31237,15 +31237,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31254,15 +31254,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31271,15 +31271,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31288,15 +31288,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31305,15 +31305,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31322,15 +31322,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31339,15 +31339,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31356,15 +31356,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31373,15 +31373,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31390,15 +31390,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31407,15 +31407,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31424,15 +31424,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31441,15 +31441,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31458,15 +31458,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31475,15 +31475,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31492,15 +31492,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31509,15 +31509,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31526,15 +31526,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31543,15 +31543,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31560,15 +31560,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31577,15 +31577,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31594,15 +31594,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31611,15 +31611,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31628,15 +31628,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31645,15 +31645,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31662,15 +31662,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31679,15 +31679,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31696,15 +31696,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31713,15 +31713,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31730,15 +31730,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31747,15 +31747,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31764,15 +31764,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31781,15 +31781,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31798,15 +31798,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31815,15 +31815,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31832,15 +31832,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31849,15 +31849,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31866,15 +31866,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31883,15 +31883,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31900,15 +31900,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31917,15 +31917,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31934,15 +31934,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31951,15 +31951,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31968,15 +31968,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -31985,15 +31985,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32002,15 +32002,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32019,15 +32019,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32036,15 +32036,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32053,15 +32053,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32070,15 +32070,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32087,15 +32087,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32104,15 +32104,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32121,15 +32121,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32138,15 +32138,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32155,15 +32155,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32172,15 +32172,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32189,15 +32189,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32206,15 +32206,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32223,15 +32223,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32240,15 +32240,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32257,15 +32257,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32274,15 +32274,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32291,15 +32291,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32308,15 +32308,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32325,15 +32325,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32342,15 +32342,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32359,15 +32359,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32376,15 +32376,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32393,15 +32393,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32410,15 +32410,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32427,15 +32427,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32444,15 +32444,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32461,15 +32461,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32478,15 +32478,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32495,15 +32495,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32512,15 +32512,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32529,15 +32529,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32546,15 +32546,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32563,15 +32563,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32580,15 +32580,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32597,15 +32597,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32614,15 +32614,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32631,15 +32631,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32648,15 +32648,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32665,15 +32665,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32682,15 +32682,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32699,15 +32699,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32716,15 +32716,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32733,15 +32733,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32750,15 +32750,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32767,15 +32767,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32784,15 +32784,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32801,15 +32801,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32818,15 +32818,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32835,15 +32835,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32852,15 +32852,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32869,15 +32869,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32886,15 +32886,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32903,15 +32903,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32920,15 +32920,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32937,15 +32937,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32954,15 +32954,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32971,15 +32971,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -32988,15 +32988,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33005,15 +33005,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33022,15 +33022,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33039,15 +33039,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33056,15 +33056,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33073,15 +33073,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33090,15 +33090,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33107,15 +33107,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33124,15 +33124,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33141,15 +33141,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33158,15 +33158,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33175,15 +33175,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33192,15 +33192,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33209,15 +33209,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33226,15 +33226,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33243,15 +33243,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33260,15 +33260,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33277,15 +33277,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33294,15 +33294,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33311,15 +33311,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33328,15 +33328,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33345,15 +33345,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33362,15 +33362,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33379,15 +33379,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33396,15 +33396,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33413,15 +33413,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33430,15 +33430,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33447,15 +33447,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33464,15 +33464,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33481,15 +33481,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33498,15 +33498,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33515,15 +33515,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33532,15 +33532,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33549,15 +33549,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33566,15 +33566,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33583,15 +33583,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33600,15 +33600,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33617,15 +33617,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33634,15 +33634,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33651,15 +33651,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33668,15 +33668,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33685,15 +33685,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33702,15 +33702,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33719,15 +33719,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33736,15 +33736,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33753,15 +33753,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33770,15 +33770,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33787,15 +33787,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33804,15 +33804,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33821,15 +33821,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33838,15 +33838,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33855,15 +33855,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33872,15 +33872,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33889,15 +33889,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33906,15 +33906,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33923,15 +33923,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33940,15 +33940,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33957,15 +33957,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33974,15 +33974,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -33991,15 +33991,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34008,15 +34008,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34025,15 +34025,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34042,15 +34042,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34059,15 +34059,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34076,15 +34076,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34093,15 +34093,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34110,15 +34110,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34127,15 +34127,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34144,15 +34144,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34161,15 +34161,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34178,15 +34178,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34195,15 +34195,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34212,15 +34212,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34229,15 +34229,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34246,15 +34246,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34263,15 +34263,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34280,15 +34280,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34297,15 +34297,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34314,15 +34314,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34331,15 +34331,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34348,15 +34348,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34365,15 +34365,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34382,15 +34382,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34399,15 +34399,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34416,15 +34416,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34433,15 +34433,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34450,15 +34450,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34467,15 +34467,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34484,15 +34484,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34501,15 +34501,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34518,15 +34518,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34535,15 +34535,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34552,15 +34552,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34569,15 +34569,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34586,15 +34586,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34603,15 +34603,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34620,15 +34620,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34637,15 +34637,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34654,15 +34654,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34671,15 +34671,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34688,15 +34688,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34705,15 +34705,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34722,15 +34722,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34739,15 +34739,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34756,15 +34756,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34773,15 +34773,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34790,15 +34790,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34807,15 +34807,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34824,15 +34824,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34841,15 +34841,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34858,15 +34858,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34875,15 +34875,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34892,15 +34892,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34909,15 +34909,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34926,15 +34926,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34943,15 +34943,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34960,15 +34960,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34977,15 +34977,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -34994,15 +34994,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35011,15 +35011,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35028,15 +35028,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35045,15 +35045,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35062,15 +35062,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35079,15 +35079,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35096,15 +35096,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35113,15 +35113,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35130,15 +35130,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35147,15 +35147,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35164,15 +35164,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35181,15 +35181,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35198,15 +35198,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35215,15 +35215,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35232,15 +35232,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35249,15 +35249,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35266,15 +35266,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35283,15 +35283,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35300,15 +35300,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35317,15 +35317,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35334,15 +35334,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35351,15 +35351,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35368,15 +35368,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35385,15 +35385,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35402,15 +35402,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35419,15 +35419,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35436,15 +35436,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35453,15 +35453,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35470,15 +35470,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35487,15 +35487,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35504,15 +35504,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35521,15 +35521,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35538,15 +35538,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35555,15 +35555,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35572,15 +35572,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35589,15 +35589,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35606,15 +35606,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35623,15 +35623,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35640,15 +35640,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35657,15 +35657,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35674,15 +35674,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35691,15 +35691,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35708,15 +35708,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35725,15 +35725,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35742,15 +35742,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35759,15 +35759,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35776,15 +35776,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35793,15 +35793,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35810,15 +35810,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35827,15 +35827,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35844,15 +35844,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35861,15 +35861,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35878,15 +35878,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35895,15 +35895,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35912,15 +35912,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35929,15 +35929,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35946,15 +35946,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35963,15 +35963,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35980,15 +35980,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -35997,15 +35997,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36014,15 +36014,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36031,15 +36031,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36048,15 +36048,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36065,15 +36065,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36082,15 +36082,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36099,15 +36099,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36116,15 +36116,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36133,15 +36133,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36150,15 +36150,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36167,15 +36167,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36184,15 +36184,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36201,15 +36201,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36218,15 +36218,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36235,15 +36235,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36252,15 +36252,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36269,15 +36269,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36286,15 +36286,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36303,15 +36303,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36320,15 +36320,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36337,15 +36337,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36354,15 +36354,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36371,15 +36371,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36388,15 +36388,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36405,15 +36405,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36422,15 +36422,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36439,15 +36439,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36456,15 +36456,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36473,15 +36473,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36490,15 +36490,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36507,15 +36507,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36524,15 +36524,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36541,15 +36541,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36558,15 +36558,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36575,15 +36575,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36592,15 +36592,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36609,15 +36609,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36626,15 +36626,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36643,15 +36643,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36660,15 +36660,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36677,15 +36677,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36694,15 +36694,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36711,15 +36711,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36728,15 +36728,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36745,15 +36745,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36762,15 +36762,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36779,15 +36779,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36796,15 +36796,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36813,15 +36813,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36830,15 +36830,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36847,15 +36847,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36864,15 +36864,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36881,15 +36881,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36898,15 +36898,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36915,15 +36915,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36932,15 +36932,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -36949,15 +36949,15 @@ }, { "techniqueID": "T1082", - "score": 25, + "score": 26, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/web_servers_executing_suspicious_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml" }, { "techniqueID": "T1003.001", "score": 17, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml" }, { "techniqueID": "T1059.005", @@ -46482,9 +46482,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46500,9 +46500,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46518,9 +46518,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46536,9 +46536,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46554,9 +46554,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46572,9 +46572,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46590,9 +46590,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46608,9 +46608,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46626,9 +46626,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46644,9 +46644,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46662,9 +46662,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46680,9 +46680,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46698,9 +46698,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46716,9 +46716,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46734,9 +46734,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46752,9 +46752,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46770,9 +46770,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46788,9 +46788,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46806,9 +46806,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46824,9 +46824,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46842,9 +46842,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46860,9 +46860,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46878,9 +46878,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46896,9 +46896,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46914,9 +46914,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46932,9 +46932,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46950,9 +46950,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46968,9 +46968,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -46986,9 +46986,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47004,9 +47004,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47022,9 +47022,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47040,9 +47040,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47058,9 +47058,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47076,9 +47076,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47094,9 +47094,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47112,9 +47112,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47130,9 +47130,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47148,9 +47148,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47166,9 +47166,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47184,9 +47184,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47202,9 +47202,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47220,9 +47220,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47238,9 +47238,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47256,9 +47256,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47274,9 +47274,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47292,9 +47292,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47310,9 +47310,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47328,9 +47328,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47346,9 +47346,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47364,9 +47364,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47382,9 +47382,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47400,9 +47400,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47418,9 +47418,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47436,9 +47436,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47454,9 +47454,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47472,9 +47472,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47490,9 +47490,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47508,9 +47508,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47526,9 +47526,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47544,9 +47544,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47562,9 +47562,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47580,9 +47580,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47598,9 +47598,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47616,9 +47616,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47634,9 +47634,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47652,9 +47652,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47670,9 +47670,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47688,9 +47688,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47706,9 +47706,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47724,9 +47724,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47742,9 +47742,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47760,9 +47760,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47778,9 +47778,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47796,9 +47796,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47814,9 +47814,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47832,9 +47832,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47850,9 +47850,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47868,9 +47868,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47886,9 +47886,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47904,9 +47904,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47922,9 +47922,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47940,9 +47940,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47958,9 +47958,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47976,9 +47976,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -47994,9 +47994,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48012,9 +48012,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48030,9 +48030,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48048,9 +48048,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48066,9 +48066,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48084,9 +48084,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48102,9 +48102,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48120,9 +48120,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48138,9 +48138,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48156,9 +48156,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48174,9 +48174,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48192,9 +48192,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48210,9 +48210,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48228,9 +48228,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48246,9 +48246,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48264,9 +48264,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48282,9 +48282,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48300,9 +48300,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48318,9 +48318,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48336,9 +48336,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48354,9 +48354,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48372,9 +48372,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48390,9 +48390,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48408,9 +48408,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48426,9 +48426,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48444,9 +48444,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48462,9 +48462,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48480,9 +48480,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48498,9 +48498,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48516,9 +48516,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48534,9 +48534,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48552,9 +48552,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48570,9 +48570,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48588,9 +48588,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48606,9 +48606,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48624,9 +48624,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48642,9 +48642,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48660,9 +48660,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48678,9 +48678,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48696,9 +48696,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48714,9 +48714,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48732,9 +48732,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48750,9 +48750,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48768,9 +48768,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48786,9 +48786,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48804,9 +48804,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48822,9 +48822,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48840,9 +48840,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48858,9 +48858,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48876,9 +48876,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48894,9 +48894,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48912,9 +48912,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48930,9 +48930,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48948,9 +48948,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48966,9 +48966,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -48984,9 +48984,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49002,9 +49002,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49020,9 +49020,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49038,9 +49038,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49056,9 +49056,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49074,9 +49074,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49092,9 +49092,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49110,9 +49110,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49128,9 +49128,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49146,9 +49146,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49164,9 +49164,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49182,9 +49182,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49200,9 +49200,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49218,9 +49218,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49236,9 +49236,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49254,9 +49254,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49272,9 +49272,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49290,9 +49290,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49308,9 +49308,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49326,9 +49326,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49344,9 +49344,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49362,9 +49362,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49380,9 +49380,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49398,9 +49398,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49416,9 +49416,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49434,9 +49434,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49452,9 +49452,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49470,9 +49470,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49488,9 +49488,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49506,9 +49506,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49524,9 +49524,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49542,9 +49542,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49560,9 +49560,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49578,9 +49578,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49596,9 +49596,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49614,9 +49614,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49632,9 +49632,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49650,9 +49650,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49668,9 +49668,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49686,9 +49686,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49704,9 +49704,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49722,9 +49722,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49740,9 +49740,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49758,9 +49758,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49776,9 +49776,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49794,9 +49794,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49812,9 +49812,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49830,9 +49830,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49848,9 +49848,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49866,9 +49866,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49884,9 +49884,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49902,9 +49902,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49920,9 +49920,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49938,9 +49938,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49956,9 +49956,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49974,9 +49974,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -49992,9 +49992,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50010,9 +50010,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50028,9 +50028,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50046,9 +50046,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50064,9 +50064,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50082,9 +50082,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50100,9 +50100,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50118,9 +50118,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50136,9 +50136,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50154,9 +50154,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50172,9 +50172,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50190,9 +50190,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50208,9 +50208,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50226,9 +50226,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50244,9 +50244,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50262,9 +50262,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50280,9 +50280,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50298,9 +50298,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50316,9 +50316,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50334,9 +50334,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50352,9 +50352,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50370,9 +50370,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50388,9 +50388,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50406,9 +50406,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50424,9 +50424,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50442,9 +50442,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50460,9 +50460,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50478,9 +50478,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50496,9 +50496,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50514,9 +50514,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50532,9 +50532,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50550,9 +50550,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50568,9 +50568,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50586,9 +50586,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50604,9 +50604,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50622,9 +50622,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50640,9 +50640,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50658,9 +50658,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50676,9 +50676,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50694,9 +50694,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50712,9 +50712,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50730,9 +50730,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50748,9 +50748,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50766,9 +50766,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50784,9 +50784,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50802,9 +50802,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50820,9 +50820,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50838,9 +50838,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50856,9 +50856,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50874,9 +50874,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50892,9 +50892,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50910,9 +50910,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50928,9 +50928,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50946,9 +50946,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50964,9 +50964,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -50982,9 +50982,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51000,9 +51000,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51018,9 +51018,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51036,9 +51036,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51054,9 +51054,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51072,9 +51072,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51090,9 +51090,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51108,9 +51108,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51126,9 +51126,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51144,9 +51144,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51162,9 +51162,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51180,9 +51180,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51198,9 +51198,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51216,9 +51216,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51234,9 +51234,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51252,9 +51252,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51270,9 +51270,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51288,9 +51288,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51306,9 +51306,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51324,9 +51324,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51342,9 +51342,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51360,9 +51360,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51378,9 +51378,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51396,9 +51396,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51414,9 +51414,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51432,9 +51432,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51450,9 +51450,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51468,9 +51468,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51486,9 +51486,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51504,9 +51504,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51522,9 +51522,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51540,9 +51540,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51558,9 +51558,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51576,9 +51576,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51594,9 +51594,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51612,9 +51612,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51630,9 +51630,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51648,9 +51648,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51666,9 +51666,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51684,9 +51684,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51702,9 +51702,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51720,9 +51720,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51738,9 +51738,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51756,9 +51756,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51774,9 +51774,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51792,9 +51792,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51810,9 +51810,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51828,9 +51828,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51846,9 +51846,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51864,9 +51864,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51882,9 +51882,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51900,9 +51900,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51918,9 +51918,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51936,9 +51936,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51954,9 +51954,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51972,9 +51972,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -51990,9 +51990,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52008,9 +52008,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52026,9 +52026,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52044,9 +52044,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52062,9 +52062,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52080,9 +52080,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52098,9 +52098,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52116,9 +52116,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52134,9 +52134,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52152,9 +52152,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52170,9 +52170,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52188,9 +52188,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52206,9 +52206,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52224,9 +52224,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52242,9 +52242,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52260,9 +52260,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52278,9 +52278,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52296,9 +52296,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52314,9 +52314,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52332,9 +52332,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52350,9 +52350,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52368,9 +52368,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52386,9 +52386,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52404,9 +52404,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52422,9 +52422,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52440,9 +52440,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52458,9 +52458,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52476,9 +52476,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52494,9 +52494,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52512,9 +52512,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52530,9 +52530,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52548,9 +52548,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52566,9 +52566,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52584,9 +52584,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52602,9 +52602,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52620,9 +52620,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52638,9 +52638,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52656,9 +52656,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52674,9 +52674,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52692,9 +52692,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52710,9 +52710,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52728,9 +52728,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52746,9 +52746,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52764,9 +52764,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52782,9 +52782,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1016", @@ -52800,9 +52800,9 @@ }, { "techniqueID": "T1203", - "score": 20, + "score": 22, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_splunk_stream.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_windows_dns_sigred_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1036.005", @@ -54577,9 +54577,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54594,9 +54593,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54611,9 +54609,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54628,9 +54625,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54645,9 +54641,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54662,9 +54657,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54679,9 +54673,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54696,9 +54689,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54713,9 +54705,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54730,9 +54721,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54747,9 +54737,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54764,9 +54753,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54781,9 +54769,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54798,9 +54785,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54815,9 +54801,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54832,9 +54817,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54849,9 +54833,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54866,9 +54849,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54883,9 +54865,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54900,9 +54881,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54917,9 +54897,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54934,9 +54913,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54951,9 +54929,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54968,9 +54945,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -54985,9 +54961,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55002,9 +54977,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55019,9 +54993,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55036,9 +55009,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55053,9 +55025,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55070,9 +55041,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55087,9 +55057,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55104,9 +55073,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55121,9 +55089,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55138,9 +55105,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55155,9 +55121,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55172,9 +55137,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55189,9 +55153,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55206,9 +55169,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55223,9 +55185,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55240,9 +55201,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55257,9 +55217,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55274,9 +55233,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55291,9 +55249,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55308,9 +55265,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55325,9 +55281,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55342,9 +55297,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55359,9 +55313,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55376,9 +55329,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55393,9 +55345,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55410,9 +55361,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55427,9 +55377,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55444,9 +55393,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55461,9 +55409,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55478,9 +55425,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55495,9 +55441,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55512,9 +55457,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55529,9 +55473,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55546,9 +55489,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55563,9 +55505,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55580,9 +55521,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55597,9 +55537,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55614,9 +55553,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55631,9 +55569,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55648,9 +55585,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55665,9 +55601,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55682,9 +55617,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55699,9 +55633,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55716,9 +55649,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55733,9 +55665,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55750,9 +55681,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55767,9 +55697,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55784,9 +55713,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55801,9 +55729,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55818,9 +55745,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55835,9 +55761,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55852,9 +55777,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55869,9 +55793,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55886,9 +55809,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55903,9 +55825,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55920,9 +55841,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55937,9 +55857,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55954,9 +55873,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55971,9 +55889,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -55988,9 +55905,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56005,9 +55921,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56022,9 +55937,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56039,9 +55953,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56056,9 +55969,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56073,9 +55985,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56090,9 +56001,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56107,9 +56017,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56124,9 +56033,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56141,9 +56049,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56158,9 +56065,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56175,9 +56081,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56192,9 +56097,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56209,9 +56113,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56226,9 +56129,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56243,9 +56145,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56260,9 +56161,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56277,9 +56177,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56294,9 +56193,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56311,9 +56209,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56328,9 +56225,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56345,9 +56241,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56362,9 +56257,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56379,9 +56273,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56396,9 +56289,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56413,9 +56305,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56430,9 +56321,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56447,9 +56337,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56464,9 +56353,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56481,9 +56369,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56498,9 +56385,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56515,9 +56401,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56532,9 +56417,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56549,9 +56433,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56566,9 +56449,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56583,9 +56465,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56600,9 +56481,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56617,9 +56497,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56634,9 +56513,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56651,9 +56529,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56668,9 +56545,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56685,9 +56561,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56702,9 +56577,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56719,9 +56593,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56736,9 +56609,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56753,9 +56625,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56770,9 +56641,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56787,9 +56657,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56804,9 +56673,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56821,9 +56689,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56838,9 +56705,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56855,9 +56721,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56872,9 +56737,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56889,9 +56753,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56906,9 +56769,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56923,9 +56785,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56940,9 +56801,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56957,9 +56817,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56974,9 +56833,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -56991,9 +56849,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57008,9 +56865,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57025,9 +56881,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57042,9 +56897,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57059,9 +56913,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57076,9 +56929,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57093,9 +56945,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57110,9 +56961,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57127,9 +56977,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57144,9 +56993,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57161,9 +57009,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57178,9 +57025,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57195,9 +57041,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57212,9 +57057,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57229,9 +57073,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57246,9 +57089,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57263,9 +57105,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57280,9 +57121,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57297,9 +57137,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57314,9 +57153,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57331,9 +57169,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57348,9 +57185,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57365,9 +57201,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57382,9 +57217,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57399,9 +57233,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57416,9 +57249,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57433,9 +57265,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57450,9 +57281,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57467,9 +57297,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57484,9 +57313,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57501,9 +57329,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57518,9 +57345,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57535,9 +57361,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57552,9 +57377,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57569,9 +57393,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57586,9 +57409,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57603,9 +57425,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57620,9 +57441,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57637,9 +57457,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57654,9 +57473,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57671,9 +57489,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57688,9 +57505,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57705,9 +57521,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57722,9 +57537,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57739,9 +57553,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57756,9 +57569,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57773,9 +57585,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57790,9 +57601,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57807,9 +57617,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57824,9 +57633,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57841,9 +57649,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57858,9 +57665,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57875,9 +57681,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57892,9 +57697,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57909,9 +57713,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57926,9 +57729,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57943,9 +57745,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57960,9 +57761,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57977,9 +57777,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -57994,9 +57793,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58011,9 +57809,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58028,9 +57825,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58045,9 +57841,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58062,9 +57857,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58079,9 +57873,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58096,9 +57889,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58113,9 +57905,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58130,9 +57921,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58147,9 +57937,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58164,9 +57953,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58181,9 +57969,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58198,9 +57985,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58215,9 +58001,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58232,9 +58017,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58249,9 +58033,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58266,9 +58049,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58283,9 +58065,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58300,9 +58081,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58317,9 +58097,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58334,9 +58113,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58351,9 +58129,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58368,9 +58145,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58385,9 +58161,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58402,9 +58177,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58419,9 +58193,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58436,9 +58209,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58453,9 +58225,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58470,9 +58241,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58487,9 +58257,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58504,9 +58273,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58521,9 +58289,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58538,9 +58305,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58555,9 +58321,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58572,9 +58337,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58589,9 +58353,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58606,9 +58369,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58623,9 +58385,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58640,9 +58401,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58657,9 +58417,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58674,9 +58433,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58691,9 +58449,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58708,9 +58465,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58725,9 +58481,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58742,9 +58497,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58759,9 +58513,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58776,9 +58529,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58793,9 +58545,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58810,9 +58561,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58827,9 +58577,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58844,9 +58593,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58861,9 +58609,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58878,9 +58625,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58895,9 +58641,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58912,9 +58657,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58929,9 +58673,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58946,9 +58689,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58963,9 +58705,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58980,9 +58721,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -58997,9 +58737,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59014,9 +58753,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59031,9 +58769,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59048,9 +58785,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59065,9 +58801,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59082,9 +58817,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59099,9 +58833,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59116,9 +58849,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59133,9 +58865,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59150,9 +58881,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59167,9 +58897,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59184,9 +58913,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59201,9 +58929,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59218,9 +58945,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59235,9 +58961,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59252,9 +58977,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59269,9 +58993,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59286,9 +59009,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59303,9 +59025,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59320,9 +59041,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59337,9 +59057,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59354,9 +59073,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59371,9 +59089,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59388,9 +59105,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59405,9 +59121,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59422,9 +59137,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59439,9 +59153,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59456,9 +59169,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59473,9 +59185,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59490,9 +59201,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59507,9 +59217,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59524,9 +59233,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59541,9 +59249,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59558,9 +59265,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59575,9 +59281,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59592,9 +59297,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59609,9 +59313,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59626,9 +59329,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59643,9 +59345,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59660,9 +59361,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59677,9 +59377,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59694,9 +59393,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59711,9 +59409,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59728,9 +59425,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59745,9 +59441,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59762,9 +59457,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59779,9 +59473,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59796,9 +59489,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59813,9 +59505,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59830,9 +59521,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59847,9 +59537,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59864,9 +59553,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59881,9 +59569,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59898,9 +59585,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59915,9 +59601,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59932,9 +59617,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59949,9 +59633,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59966,9 +59649,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -59983,9 +59665,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60000,9 +59681,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60017,9 +59697,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60034,9 +59713,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60051,9 +59729,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60068,9 +59745,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60085,9 +59761,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60102,9 +59777,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60119,9 +59793,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60136,9 +59809,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60153,9 +59825,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60170,9 +59841,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60187,9 +59857,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60204,9 +59873,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60221,9 +59889,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60238,9 +59905,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60255,9 +59921,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60272,9 +59937,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60289,9 +59953,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60306,9 +59969,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60323,9 +59985,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60340,9 +60001,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60357,9 +60017,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60374,9 +60033,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60391,9 +60049,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60408,9 +60065,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60425,9 +60081,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60442,9 +60097,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60459,9 +60113,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60476,9 +60129,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60493,9 +60145,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60510,9 +60161,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60527,9 +60177,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1055", @@ -60544,9 +60193,8 @@ }, { "techniqueID": "T1021.001", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_desktop_network_traffic.yml" + "score": 21, + "showSubtechniques": false }, { "techniqueID": "T1056.001", @@ -60566,9 +60214,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -60593,37 +60240,9 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" - }, - { - "techniqueID": "T1204.001", "score": 20, "showSubtechniques": false }, - { - "techniqueID": "T1056.001", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1140", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1059", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" - }, { "techniqueID": "T1204.001", "score": 20, @@ -60647,9 +60266,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -60674,9 +60292,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -60701,9 +60318,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -60728,9 +60344,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -60755,9 +60370,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -60782,9 +60396,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -60809,9 +60422,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -60836,9 +60448,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -60863,9 +60474,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -60890,9 +60500,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -60917,9 +60526,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -60944,9 +60552,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -60971,9 +60578,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -60998,9 +60604,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61025,9 +60630,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61052,9 +60656,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61079,9 +60682,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61106,9 +60708,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61133,9 +60734,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61160,9 +60760,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61187,9 +60786,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61214,9 +60812,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61241,9 +60838,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61268,9 +60864,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61295,9 +60890,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61322,9 +60916,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61349,9 +60942,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61376,9 +60968,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61403,9 +60994,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61430,9 +61020,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61457,9 +61046,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61484,9 +61072,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61511,9 +61098,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61538,9 +61124,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61565,9 +61150,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61592,9 +61176,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61619,9 +61202,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61646,9 +61228,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61673,9 +61254,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61700,9 +61280,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61727,9 +61306,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61754,9 +61332,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61781,9 +61358,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61808,9 +61384,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61835,9 +61410,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61862,9 +61436,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61889,9 +61462,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61916,9 +61488,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61943,9 +61514,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61970,9 +61540,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -61997,9 +61566,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62024,9 +61592,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62051,9 +61618,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62078,9 +61644,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62105,9 +61670,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62132,9 +61696,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62159,9 +61722,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62186,9 +61748,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62213,37 +61774,9 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" - }, - { - "techniqueID": "T1204.001", "score": 20, "showSubtechniques": false }, - { - "techniqueID": "T1056.001", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1140", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1059", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" - }, { "techniqueID": "T1204.001", "score": 20, @@ -62267,9 +61800,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62294,9 +61826,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62321,9 +61852,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62348,9 +61878,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62375,9 +61904,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62402,9 +61930,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62429,9 +61956,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62456,9 +61982,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62483,9 +62008,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62510,9 +62034,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62537,9 +62060,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62564,9 +62086,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62591,9 +62112,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62618,9 +62138,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62645,9 +62164,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62672,9 +62190,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62699,9 +62216,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62726,9 +62242,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62753,9 +62268,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62780,9 +62294,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62807,9 +62320,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62834,9 +62346,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62861,9 +62372,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62888,9 +62398,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62915,9 +62424,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62942,9 +62450,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62969,9 +62476,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -62996,9 +62502,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63023,9 +62528,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63050,9 +62554,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63077,9 +62580,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63104,9 +62606,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63131,9 +62632,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63158,9 +62658,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63185,9 +62684,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63212,9 +62710,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63239,9 +62736,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63266,9 +62762,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63293,9 +62788,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63320,9 +62814,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63347,9 +62840,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63374,9 +62866,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63401,9 +62892,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63428,9 +62918,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63455,9 +62944,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63482,9 +62970,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63509,9 +62996,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63536,9 +63022,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63563,9 +63048,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63590,9 +63074,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63617,9 +63100,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63644,9 +63126,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63671,9 +63152,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63698,9 +63178,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63725,9 +63204,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63752,9 +63230,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63779,9 +63256,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63806,9 +63282,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63833,37 +63308,9 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" - }, - { - "techniqueID": "T1204.001", "score": 20, "showSubtechniques": false }, - { - "techniqueID": "T1056.001", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1140", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1059", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" - }, { "techniqueID": "T1204.001", "score": 20, @@ -63887,9 +63334,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63914,9 +63360,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63941,9 +63386,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63968,9 +63412,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -63995,9 +63438,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64022,9 +63464,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64049,9 +63490,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64076,9 +63516,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64103,9 +63542,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64130,9 +63568,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64157,9 +63594,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64184,9 +63620,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64211,9 +63646,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64238,9 +63672,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64265,9 +63698,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64292,9 +63724,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64319,9 +63750,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64346,9 +63776,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64373,9 +63802,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64400,9 +63828,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64427,9 +63854,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64454,9 +63880,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64481,9 +63906,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64508,9 +63932,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64535,9 +63958,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64562,9 +63984,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64589,9 +64010,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64616,9 +64036,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64643,9 +64062,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64670,9 +64088,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64697,9 +64114,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64724,9 +64140,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64751,9 +64166,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64778,9 +64192,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64805,9 +64218,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64832,9 +64244,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64859,9 +64270,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64886,9 +64296,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64913,9 +64322,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64940,9 +64348,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64967,9 +64374,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -64994,9 +64400,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65021,9 +64426,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65048,9 +64452,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65075,9 +64478,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65102,9 +64504,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65129,9 +64530,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65156,9 +64556,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65183,9 +64582,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65210,9 +64608,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65237,9 +64634,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65264,9 +64660,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65291,9 +64686,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65318,9 +64712,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65345,9 +64738,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65372,9 +64764,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65399,9 +64790,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65426,9 +64816,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65453,37 +64842,9 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" - }, - { - "techniqueID": "T1204.001", "score": 20, "showSubtechniques": false }, - { - "techniqueID": "T1056.001", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1140", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1059", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" - }, { "techniqueID": "T1204.001", "score": 20, @@ -65507,9 +64868,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65534,9 +64894,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65561,9 +64920,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65588,9 +64946,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65615,9 +64972,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65642,9 +64998,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65669,9 +65024,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65696,9 +65050,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65723,9 +65076,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65750,9 +65102,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65777,9 +65128,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65804,9 +65154,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65831,9 +65180,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65858,9 +65206,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65885,9 +65232,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65912,9 +65258,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65939,9 +65284,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65966,9 +65310,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -65993,9 +65336,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66020,9 +65362,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66047,9 +65388,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66074,9 +65414,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66101,9 +65440,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66128,9 +65466,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66155,9 +65492,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66182,9 +65518,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66209,9 +65544,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66236,9 +65570,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66263,9 +65596,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66290,9 +65622,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66317,9 +65648,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66344,9 +65674,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66371,9 +65700,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66398,9 +65726,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66425,9 +65752,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66452,9 +65778,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66479,9 +65804,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66506,9 +65830,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66533,9 +65856,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66560,9 +65882,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66587,9 +65908,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66614,9 +65934,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66641,9 +65960,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66668,9 +65986,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66695,9 +66012,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66722,9 +66038,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66749,9 +66064,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66776,9 +66090,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66803,9 +66116,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66830,9 +66142,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66857,9 +66168,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66884,9 +66194,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66911,9 +66220,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66938,9 +66246,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66965,9 +66272,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -66992,9 +66298,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67019,9 +66324,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67046,9 +66350,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67073,37 +66376,9 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" - }, - { - "techniqueID": "T1204.001", "score": 20, "showSubtechniques": false }, - { - "techniqueID": "T1056.001", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1140", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1059", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" - }, { "techniqueID": "T1204.001", "score": 20, @@ -67127,9 +66402,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67154,9 +66428,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67181,9 +66454,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67208,9 +66480,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67235,9 +66506,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67262,9 +66532,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67289,9 +66558,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67316,9 +66584,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67343,9 +66610,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67370,9 +66636,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67397,9 +66662,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67424,9 +66688,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67451,9 +66714,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67478,9 +66740,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67505,9 +66766,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67532,9 +66792,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67559,9 +66818,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67586,9 +66844,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67613,9 +66870,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67640,9 +66896,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67667,9 +66922,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67694,9 +66948,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67721,9 +66974,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67748,9 +67000,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67775,9 +67026,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67802,9 +67052,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67829,9 +67078,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67856,9 +67104,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67883,9 +67130,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67910,9 +67156,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67937,9 +67182,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67964,9 +67208,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -67991,9 +67234,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68018,9 +67260,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68045,9 +67286,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68072,9 +67312,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68099,9 +67338,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68126,9 +67364,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68153,9 +67390,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68180,9 +67416,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68207,9 +67442,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68234,9 +67468,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68261,9 +67494,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68288,9 +67520,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68315,9 +67546,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68342,9 +67572,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68369,9 +67598,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68396,9 +67624,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68423,9 +67650,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68450,9 +67676,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68477,9 +67702,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68504,9 +67728,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68531,9 +67754,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68558,9 +67780,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68585,9 +67806,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68612,9 +67832,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68639,9 +67858,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68666,9 +67884,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68693,37 +67910,9 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" - }, - { - "techniqueID": "T1204.001", "score": 20, "showSubtechniques": false }, - { - "techniqueID": "T1056.001", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1140", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1059", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" - }, { "techniqueID": "T1204.001", "score": 20, @@ -68747,37 +67936,9 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" - }, - { - "techniqueID": "T1204.001", "score": 20, "showSubtechniques": false }, - { - "techniqueID": "T1056.001", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1140", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1059", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" - }, { "techniqueID": "T1204.001", "score": 20, @@ -68801,37 +67962,9 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" - }, - { - "techniqueID": "T1204.001", "score": 20, "showSubtechniques": false }, - { - "techniqueID": "T1056.001", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1140", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1059", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" - }, { "techniqueID": "T1204.001", "score": 20, @@ -68855,37 +67988,9 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" - }, - { - "techniqueID": "T1204.001", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1056.001", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1140", "score": 20, "showSubtechniques": false }, - { - "techniqueID": "T1059", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" - }, { "techniqueID": "T1204.001", "score": 20, @@ -68909,37 +68014,9 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" - }, - { - "techniqueID": "T1204.001", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1056.001", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1140", "score": 20, "showSubtechniques": false }, - { - "techniqueID": "T1059", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" - }, { "techniqueID": "T1204.001", "score": 20, @@ -68963,9 +68040,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -68990,9 +68066,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69017,9 +68092,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69044,9 +68118,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69071,9 +68144,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69098,9 +68170,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69125,9 +68196,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69152,9 +68222,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69179,9 +68248,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69206,9 +68274,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69233,9 +68300,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69260,9 +68326,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69287,9 +68352,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69314,9 +68378,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69341,9 +68404,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69368,9 +68430,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69395,9 +68456,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69422,9 +68482,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69449,9 +68508,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69476,9 +68534,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69503,9 +68560,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69530,9 +68586,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69557,9 +68612,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69584,9 +68638,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69611,9 +68664,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69638,9 +68690,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69665,9 +68716,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69692,9 +68742,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69719,9 +68768,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69746,9 +68794,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69773,9 +68820,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69800,9 +68846,8 @@ }, { "techniqueID": "T1018", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69827,9 +68872,34 @@ }, { "techniqueID": "T1018", - "score": 19, + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1059", + "score": 16, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69854,9 +68924,34 @@ }, { "techniqueID": "T1018", - "score": 19, + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1059", + "score": 16, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69881,9 +68976,34 @@ }, { "techniqueID": "T1018", - "score": 19, + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1059", + "score": 16, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69908,9 +69028,34 @@ }, { "techniqueID": "T1018", - "score": 19, + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1059", + "score": 16, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69935,9 +69080,60 @@ }, { "techniqueID": "T1018", - "score": 19, + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1059", + "score": 16, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1059", + "score": 16, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69962,9 +69158,34 @@ }, { "techniqueID": "T1018", - "score": 19, + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1059", + "score": 16, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -69989,9 +69210,34 @@ }, { "techniqueID": "T1018", - "score": 19, + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1059", + "score": 16, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -70016,9 +69262,34 @@ }, { "techniqueID": "T1018", - "score": 19, + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1059", + "score": 16, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -70043,9 +69314,34 @@ }, { "techniqueID": "T1018", - "score": 19, + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1059", + "score": 16, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_adfind_exe.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1204.001", @@ -100337,9 +99633,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -100375,9 +99671,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -100413,9 +99709,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -100451,9 +99747,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -100489,9 +99785,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -100527,9 +99823,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -100565,9 +99861,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -100603,9 +99899,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -100641,9 +99937,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -100679,9 +99975,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -100717,9 +100013,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -100755,9 +100051,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -100793,9 +100089,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -100831,9 +100127,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -100869,9 +100165,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -100907,9 +100203,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -100945,9 +100241,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -100983,9 +100279,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101021,9 +100317,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101059,9 +100355,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101097,9 +100393,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101135,9 +100431,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101173,9 +100469,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101211,9 +100507,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101249,9 +100545,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101287,9 +100583,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101325,9 +100621,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101363,9 +100659,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101401,9 +100697,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101439,9 +100735,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101477,9 +100773,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101515,9 +100811,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101553,9 +100849,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101591,9 +100887,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101629,9 +100925,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101667,9 +100963,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101705,9 +101001,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101743,9 +101039,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101781,9 +101077,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101819,9 +101115,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101857,9 +101153,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101895,9 +101191,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101933,9 +101229,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -101971,9 +101267,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102009,9 +101305,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102047,9 +101343,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102085,9 +101381,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102123,9 +101419,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102161,9 +101457,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102199,9 +101495,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102237,9 +101533,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102275,9 +101571,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102313,9 +101609,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102351,9 +101647,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102389,9 +101685,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102427,9 +101723,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102465,9 +101761,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102503,9 +101799,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102541,9 +101837,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102579,9 +101875,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102617,9 +101913,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102655,9 +101951,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102693,9 +101989,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102731,9 +102027,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102769,9 +102065,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102807,9 +102103,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102845,9 +102141,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102883,9 +102179,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102921,9 +102217,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102959,9 +102255,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -102997,9 +102293,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103035,9 +102331,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103073,9 +102369,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103111,9 +102407,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103149,9 +102445,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103187,9 +102483,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103225,9 +102521,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103263,9 +102559,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103301,9 +102597,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103339,9 +102635,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103377,9 +102673,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103415,9 +102711,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103453,9 +102749,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103491,9 +102787,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103529,9 +102825,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103567,9 +102863,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103605,9 +102901,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103643,9 +102939,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103681,9 +102977,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103719,9 +103015,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103757,9 +103053,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103795,9 +103091,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103833,9 +103129,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103871,9 +103167,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103909,9 +103205,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103947,9 +103243,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -103985,9 +103281,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104023,9 +103319,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104061,9 +103357,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104099,9 +103395,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104137,9 +103433,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104175,9 +103471,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104213,9 +103509,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104251,9 +103547,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104289,9 +103585,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104327,9 +103623,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104365,9 +103661,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104403,9 +103699,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104441,9 +103737,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104479,9 +103775,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104517,9 +103813,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104555,9 +103851,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104593,9 +103889,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104631,9 +103927,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104669,9 +103965,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104707,9 +104003,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104745,9 +104041,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104783,9 +104079,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104821,9 +104117,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104859,9 +104155,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104897,9 +104193,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104935,9 +104231,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -104973,9 +104269,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105011,9 +104307,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105049,9 +104345,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105087,9 +104383,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105125,9 +104421,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105163,9 +104459,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105201,9 +104497,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105239,9 +104535,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105277,9 +104573,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105315,9 +104611,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105353,9 +104649,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105391,9 +104687,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105429,9 +104725,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105467,9 +104763,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105505,9 +104801,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105543,9 +104839,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105581,9 +104877,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105619,9 +104915,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105657,9 +104953,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105695,9 +104991,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105733,9 +105029,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105771,9 +105067,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105809,9 +105105,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105847,9 +105143,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105885,9 +105181,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105923,9 +105219,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105961,9 +105257,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -105999,9 +105295,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106037,9 +105333,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106075,9 +105371,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106113,9 +105409,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106151,9 +105447,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106189,9 +105485,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106227,9 +105523,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106265,9 +105561,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106303,9 +105599,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106341,9 +105637,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106379,9 +105675,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106417,9 +105713,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106455,9 +105751,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106493,9 +105789,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106531,9 +105827,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106569,9 +105865,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106607,9 +105903,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106645,9 +105941,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106683,9 +105979,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106721,9 +106017,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106759,9 +106055,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106797,9 +106093,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106835,9 +106131,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106873,9 +106169,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106911,9 +106207,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106949,9 +106245,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -106987,9 +106283,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107025,9 +106321,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107063,9 +106359,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107101,9 +106397,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107139,9 +106435,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107177,9 +106473,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107215,9 +106511,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107253,9 +106549,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107291,9 +106587,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107329,9 +106625,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107367,9 +106663,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107405,9 +106701,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107443,9 +106739,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107481,9 +106777,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107519,9 +106815,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107557,9 +106853,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107595,9 +106891,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107633,9 +106929,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107671,9 +106967,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107709,9 +107005,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107747,9 +107043,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107785,9 +107081,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107823,9 +107119,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107861,9 +107157,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107899,9 +107195,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107937,9 +107233,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -107975,9 +107271,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108013,9 +107309,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108051,9 +107347,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108089,9 +107385,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108127,9 +107423,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108165,9 +107461,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108203,9 +107499,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108241,9 +107537,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108279,9 +107575,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108317,9 +107613,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108355,9 +107651,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108393,9 +107689,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108431,9 +107727,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108469,9 +107765,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108507,9 +107803,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108545,9 +107841,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108583,9 +107879,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108621,9 +107917,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108659,9 +107955,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108697,9 +107993,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108735,9 +108031,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108773,9 +108069,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108811,9 +108107,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108849,9 +108145,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108887,9 +108183,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108925,9 +108221,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -108963,9 +108259,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109001,9 +108297,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109039,9 +108335,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109077,9 +108373,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109115,9 +108411,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109153,9 +108449,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109191,9 +108487,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109229,9 +108525,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109267,9 +108563,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109305,9 +108601,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109343,9 +108639,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109381,9 +108677,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109419,9 +108715,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109457,9 +108753,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109495,9 +108791,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109533,9 +108829,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109571,9 +108867,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109609,9 +108905,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109647,9 +108943,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109685,9 +108981,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109723,9 +109019,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109761,9 +109057,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109799,9 +109095,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109837,9 +109133,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109875,9 +109171,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109913,9 +109209,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109951,9 +109247,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -109989,9 +109285,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110027,9 +109323,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110065,9 +109361,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110103,9 +109399,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110141,9 +109437,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110179,9 +109475,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110217,9 +109513,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110255,9 +109551,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110293,9 +109589,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110331,9 +109627,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110369,9 +109665,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110407,9 +109703,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110445,9 +109741,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110483,9 +109779,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110521,9 +109817,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110559,9 +109855,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110597,9 +109893,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110635,9 +109931,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110673,9 +109969,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110711,9 +110007,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110749,9 +110045,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110787,9 +110083,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110825,9 +110121,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110863,9 +110159,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110901,9 +110197,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110939,9 +110235,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -110977,9 +110273,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111015,9 +110311,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111053,9 +110349,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111091,9 +110387,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111129,9 +110425,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111167,9 +110463,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111205,9 +110501,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111243,9 +110539,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111281,9 +110577,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111319,9 +110615,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111357,9 +110653,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111395,9 +110691,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111433,9 +110729,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111471,9 +110767,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111509,9 +110805,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111547,9 +110843,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111585,9 +110881,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111623,9 +110919,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111661,9 +110957,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111699,9 +110995,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111737,9 +111033,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111775,9 +111071,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111813,9 +111109,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111851,9 +111147,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111889,9 +111185,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111927,9 +111223,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -111965,9 +111261,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112003,9 +111299,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112041,9 +111337,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112079,9 +111375,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112117,9 +111413,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112155,9 +111451,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112193,9 +111489,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112231,9 +111527,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112269,9 +111565,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112307,9 +111603,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112345,9 +111641,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112383,9 +111679,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112421,9 +111717,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112459,9 +111755,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112497,9 +111793,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112535,9 +111831,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112573,9 +111869,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112611,9 +111907,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112649,9 +111945,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112687,9 +111983,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112725,9 +112021,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112763,9 +112059,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112801,9 +112097,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112839,9 +112135,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112877,9 +112173,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112915,9 +112211,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112953,9 +112249,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -112991,9 +112287,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -113029,9 +112325,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -113067,9 +112363,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -113105,9 +112401,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -113143,9 +112439,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -113181,9 +112477,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -113219,9 +112515,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -113257,9 +112553,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -113295,9 +112591,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -113333,9 +112629,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -113371,9 +112667,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -113409,9 +112705,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -113447,9 +112743,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -113485,9 +112781,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -113523,9 +112819,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -113561,9 +112857,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -113599,9 +112895,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -113637,9 +112933,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -113675,9 +112971,9 @@ }, { "techniqueID": "T1021.002", - "score": 7, + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/smb_traffic_spike___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { "techniqueID": "T1085", @@ -113720,7 +113016,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -113746,71 +113042,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -113842,7 +113076,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -113868,9 +113102,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -113903,7 +113136,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -113929,9 +113162,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -113964,7 +113196,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -113990,9 +113222,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -114025,7 +113256,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -114051,71 +113282,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -114147,7 +113316,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -114173,71 +113342,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -114269,7 +113376,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -114295,71 +113402,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -114391,7 +113436,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -114417,9 +113462,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -114452,7 +113496,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -114478,9 +113522,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -114513,7 +113556,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -114539,9 +113582,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -114574,7 +113616,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -114600,9 +113642,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -114635,7 +113676,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -114661,9 +113702,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -114696,7 +113736,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -114722,9 +113762,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -114757,7 +113796,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -114783,9 +113822,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -114818,7 +113856,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -114844,9 +113882,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -114879,7 +113916,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -114905,9 +113942,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -114940,7 +113976,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -114966,9 +114002,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -115001,7 +114036,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -115027,9 +114062,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -115062,7 +114096,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -115088,9 +114122,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -115123,7 +114156,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -115149,9 +114182,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -115184,7 +114216,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -115210,9 +114242,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -115245,7 +114276,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -115271,9 +114302,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -115306,7 +114336,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -115332,9 +114362,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -115367,7 +114396,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -115393,9 +114422,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -115428,7 +114456,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -115454,9 +114482,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -115489,7 +114516,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -115515,9 +114542,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -115550,7 +114576,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -115576,9 +114602,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -115611,7 +114636,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -115637,71 +114662,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -115733,7 +114696,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -115759,71 +114722,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -115855,7 +114756,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -115881,71 +114782,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -115977,7 +114816,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -116003,9 +114842,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -116038,7 +114876,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -116064,9 +114902,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -116099,7 +114936,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -116125,9 +114962,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -116160,7 +114996,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -116186,9 +115022,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -116221,7 +115056,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -116247,9 +115082,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -116282,7 +115116,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -116308,9 +115142,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -116343,7 +115176,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -116369,9 +115202,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -116404,7 +115236,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -116430,9 +115262,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -116465,7 +115296,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -116491,9 +115322,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -116526,7 +115356,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -116552,9 +115382,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -116587,7 +115416,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -116613,9 +115442,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -116648,7 +115476,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -116674,9 +115502,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -116709,7 +115536,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -116735,9 +115562,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -116770,7 +115596,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -116796,9 +115622,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -116831,7 +115656,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -116857,9 +115682,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -116892,7 +115716,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -116918,9 +115742,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -116953,7 +115776,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -116979,9 +115802,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -117014,7 +115836,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -117040,9 +115862,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -117075,7 +115896,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -117101,9 +115922,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -117136,7 +115956,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -117162,9 +115982,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -117197,7 +116016,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -117223,71 +116042,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -117319,7 +116076,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -117345,71 +116102,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -117441,7 +116136,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -117467,71 +116162,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -117563,7 +116196,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -117589,9 +116222,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -117624,7 +116256,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -117650,9 +116282,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -117685,7 +116316,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -117711,9 +116342,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -117746,7 +116376,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -117772,9 +116402,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -117807,7 +116436,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -117833,9 +116462,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -117868,7 +116496,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -117894,9 +116522,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -117929,7 +116556,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -117955,9 +116582,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -117990,7 +116616,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -118016,9 +116642,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -118051,7 +116676,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -118077,9 +116702,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -118112,7 +116736,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -118138,9 +116762,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -118173,7 +116796,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -118199,9 +116822,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -118234,7 +116856,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -118260,9 +116882,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -118295,7 +116916,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -118321,9 +116942,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -118356,7 +116976,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -118382,9 +117002,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -118417,7 +117036,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -118443,9 +117062,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -118478,7 +117096,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -118504,9 +117122,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -118539,7 +117156,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -118565,9 +117182,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -118600,7 +117216,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -118626,9 +117242,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -118661,7 +117276,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -118687,9 +117302,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -118722,7 +117336,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -118748,9 +117362,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -118783,7 +117396,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -118809,71 +117422,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -118905,7 +117456,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -118931,71 +117482,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -119027,7 +117516,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -119053,71 +117542,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -119149,7 +117576,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -119175,9 +117602,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -119210,7 +117636,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -119236,9 +117662,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -119271,7 +117696,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -119297,9 +117722,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -119332,7 +117756,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -119358,9 +117782,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -119393,7 +117816,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -119419,9 +117842,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -119454,7 +117876,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -119480,9 +117902,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -119515,7 +117936,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -119541,9 +117962,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -119576,7 +117996,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -119602,9 +118022,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -119637,7 +118056,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -119663,9 +118082,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -119698,7 +118116,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -119724,9 +118142,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -119759,7 +118176,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -119785,9 +118202,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -119820,7 +118236,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -119846,9 +118262,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -119881,7 +118296,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -119907,9 +118322,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -119942,7 +118356,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -119968,9 +118382,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -120003,7 +118416,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -120029,9 +118442,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -120064,7 +118476,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -120090,9 +118502,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -120125,7 +118536,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -120151,9 +118562,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -120186,7 +118596,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -120212,9 +118622,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -120247,7 +118656,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -120273,9 +118682,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -120308,7 +118716,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -120334,9 +118742,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -120369,7 +118776,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -120395,71 +118802,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -120491,7 +118836,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -120517,71 +118862,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -120613,7 +118896,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -120639,71 +118922,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -120735,7 +118956,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -120761,9 +118982,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -120796,7 +119016,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -120822,9 +119042,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -120857,7 +119076,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -120883,9 +119102,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -120918,7 +119136,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -120944,9 +119162,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -120979,7 +119196,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -121005,9 +119222,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -121040,7 +119256,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -121066,9 +119282,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -121101,7 +119316,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -121127,9 +119342,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -121162,7 +119376,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -121188,9 +119402,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -121223,7 +119436,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -121249,9 +119462,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -121284,7 +119496,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -121310,9 +119522,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -121345,7 +119556,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -121371,9 +119582,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -121406,7 +119616,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -121432,9 +119642,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -121467,7 +119676,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -121493,9 +119702,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -121528,7 +119736,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -121554,9 +119762,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -121589,7 +119796,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -121615,9 +119822,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -121650,7 +119856,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -121676,9 +119882,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -121711,7 +119916,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -121737,9 +119942,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -121772,7 +119976,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -121798,9 +120002,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -121833,7 +120036,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -121859,9 +120062,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -121894,7 +120096,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -121920,9 +120122,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -121955,7 +120156,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -121981,71 +120182,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -122077,7 +120216,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -122103,71 +120242,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -122199,7 +120276,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -122225,71 +120302,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -122321,7 +120336,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -122347,9 +120362,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -122382,7 +120396,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -122408,9 +120422,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -122443,7 +120456,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -122469,9 +120482,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -122504,7 +120516,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -122530,9 +120542,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -122565,7 +120576,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -122591,9 +120602,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -122626,7 +120636,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -122652,9 +120662,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -122687,7 +120696,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -122713,9 +120722,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -122748,7 +120756,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -122774,9 +120782,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -122809,7 +120816,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -122835,9 +120842,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -122870,7 +120876,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -122896,9 +120902,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -122931,7 +120936,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -122957,9 +120962,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -122992,7 +120996,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -123018,9 +121022,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -123053,7 +121056,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -123079,9 +121082,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -123114,7 +121116,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -123140,9 +121142,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -123175,7 +121176,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -123201,9 +121202,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -123236,7 +121236,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -123262,9 +121262,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -123297,7 +121296,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -123323,9 +121322,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -123358,7 +121356,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -123384,9 +121382,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -123419,7 +121416,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -123445,9 +121442,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -123480,7 +121476,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -123506,9 +121502,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -123541,7 +121536,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -123567,71 +121562,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -123663,7 +121596,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -123689,71 +121622,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -123785,7 +121656,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -123811,71 +121682,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -123907,7 +121716,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -123933,9 +121742,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -123968,7 +121776,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -123994,9 +121802,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -124029,7 +121836,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -124055,9 +121862,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -124090,7 +121896,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -124116,9 +121922,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -124151,7 +121956,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -124177,9 +121982,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -124212,7 +122016,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -124238,9 +122042,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -124273,7 +122076,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -124299,9 +122102,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -124334,7 +122136,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -124360,9 +122162,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -124395,7 +122196,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -124421,9 +122222,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -124456,7 +122256,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -124482,9 +122282,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -124517,7 +122316,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -124543,9 +122342,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -124578,7 +122376,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -124604,9 +122402,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -124639,7 +122436,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -124665,9 +122462,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -124700,7 +122496,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -124726,9 +122522,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -124761,7 +122556,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -124787,9 +122582,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -124822,7 +122616,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -124848,9 +122642,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -124883,7 +122676,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -124909,9 +122702,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -124944,7 +122736,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -124970,9 +122762,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -125005,7 +122796,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -125031,9 +122822,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -125066,7 +122856,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -125092,9 +122882,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -125127,7 +122916,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -125153,71 +122942,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -125249,7 +122976,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -125275,71 +123002,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -125371,7 +123036,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -125397,71 +123062,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -125493,7 +123096,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -125519,9 +123122,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -125554,7 +123156,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -125580,9 +123182,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -125615,7 +123216,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -125641,9 +123242,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -125676,7 +123276,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -125702,9 +123302,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -125737,7 +123336,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -125763,9 +123362,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -125798,7 +123396,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -125824,9 +123422,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -125859,7 +123456,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -125885,9 +123482,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -125920,7 +123516,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -125946,9 +123542,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -125981,7 +123576,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -126007,9 +123602,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -126042,7 +123636,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -126068,9 +123662,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -126103,7 +123696,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -126129,9 +123722,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -126164,7 +123756,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -126190,9 +123782,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -126225,7 +123816,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -126251,9 +123842,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -126286,7 +123876,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -126312,9 +123902,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -126347,7 +123936,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -126373,9 +123962,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -126408,7 +123996,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -126434,9 +124022,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -126469,7 +124056,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -126495,9 +124082,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -126530,7 +124116,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -126556,9 +124142,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -126591,7 +124176,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -126617,9 +124202,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -126652,7 +124236,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -126678,9 +124262,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -126713,7 +124296,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -126739,71 +124322,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -126835,7 +124356,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -126861,71 +124382,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -126957,7 +124416,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -126983,71 +124442,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -127079,7 +124476,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -127105,9 +124502,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -127140,7 +124536,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -127166,9 +124562,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -127201,7 +124596,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -127227,9 +124622,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -127262,7 +124656,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -127288,9 +124682,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -127323,7 +124716,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -127349,9 +124742,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -127384,7 +124776,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -127410,9 +124802,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -127445,7 +124836,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -127471,9 +124862,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -127506,7 +124896,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -127532,9 +124922,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -127567,7 +124956,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -127593,9 +124982,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -127628,7 +125016,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -127654,9 +125042,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -127689,7 +125076,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -127715,9 +125102,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -127750,7 +125136,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -127776,9 +125162,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -127811,7 +125196,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -127837,9 +125222,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -127872,7 +125256,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -127898,9 +125282,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -127933,7 +125316,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -127959,9 +125342,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -127994,7 +125376,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -128020,9 +125402,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -128055,7 +125436,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -128081,9 +125462,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -128116,7 +125496,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -128142,9 +125522,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -128177,7 +125556,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -128203,9 +125582,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -128238,7 +125616,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -128264,9 +125642,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -128299,7 +125676,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -128325,71 +125702,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -128421,7 +125736,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -128447,71 +125762,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -128543,7 +125796,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -128569,71 +125822,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -128665,7 +125856,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -128691,9 +125882,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -128726,7 +125916,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -128752,9 +125942,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -128787,7 +125976,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -128813,9 +126002,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -128848,7 +126036,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -128874,9 +126062,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -128909,7 +126096,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -128935,9 +126122,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -128970,7 +126156,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -128996,9 +126182,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -129031,7 +126216,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -129057,9 +126242,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -129092,7 +126276,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -129118,9 +126302,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -129153,7 +126336,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -129179,9 +126362,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -129214,7 +126396,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -129240,9 +126422,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -129275,7 +126456,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -129301,9 +126482,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -129336,7 +126516,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -129362,9 +126542,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -129397,7 +126576,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -129423,9 +126602,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -129458,7 +126636,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -129484,9 +126662,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -129519,7 +126696,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -129545,9 +126722,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -129580,7 +126756,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -129606,9 +126782,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -129641,7 +126816,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -129667,9 +126842,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -129702,7 +126876,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -129728,9 +126902,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -129763,7 +126936,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -129789,9 +126962,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -129824,7 +126996,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -129850,9 +127022,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -129885,7 +127056,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -129911,71 +127082,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -130007,7 +127116,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -130033,71 +127142,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -130129,7 +127176,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -130155,71 +127202,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -130251,7 +127236,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -130277,9 +127262,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -130312,7 +127296,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -130338,9 +127322,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -130373,7 +127356,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -130399,9 +127382,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -130434,7 +127416,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -130460,9 +127442,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -130495,7 +127476,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -130521,9 +127502,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -130556,7 +127536,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -130582,9 +127562,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -130617,7 +127596,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -130643,9 +127622,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -130678,7 +127656,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -130704,9 +127682,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -130739,7 +127716,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -130765,9 +127742,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -130800,7 +127776,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -130826,9 +127802,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -130861,7 +127836,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -130887,9 +127862,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -130922,7 +127896,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -130948,9 +127922,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -130983,7 +127956,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -131009,9 +127982,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -131044,7 +128016,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -131070,9 +128042,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -131105,7 +128076,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -131131,9 +128102,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -131166,7 +128136,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -131192,9 +128162,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -131227,7 +128196,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -131253,9 +128222,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -131288,7 +128256,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -131314,9 +128282,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -131349,7 +128316,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -131375,9 +128342,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -131410,7 +128376,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -131436,9 +128402,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -131471,7 +128436,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -131497,71 +128462,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -131593,7 +128496,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -131619,71 +128522,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -131715,7 +128556,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -131741,71 +128582,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -131837,7 +128616,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -131863,9 +128642,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -131898,7 +128676,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -131924,9 +128702,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -131959,7 +128736,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -131985,9 +128762,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -132020,7 +128796,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -132046,9 +128822,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -132081,7 +128856,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -132107,9 +128882,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -132142,7 +128916,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -132168,9 +128942,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -132203,7 +128976,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -132229,9 +129002,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -132264,7 +129036,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -132290,9 +129062,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -132325,7 +129096,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -132351,9 +129122,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -132386,7 +129156,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -132412,9 +129182,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -132447,7 +129216,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -132473,9 +129242,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -132508,7 +129276,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -132534,9 +129302,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -132569,7 +129336,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -132595,9 +129362,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -132630,7 +129396,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -132656,9 +129422,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -132691,7 +129456,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -132717,9 +129482,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -132752,7 +129516,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -132778,9 +129542,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -132813,7 +129576,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -132839,9 +129602,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -132874,7 +129636,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -132900,9 +129662,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -132935,7 +129696,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -132961,9 +129722,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -132996,7 +129756,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -133022,9 +129782,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -133057,7 +129816,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -133083,71 +129842,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -133179,7 +129876,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -133205,71 +129902,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -133301,7 +129936,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -133327,71 +129962,9 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, - { - "techniqueID": "T1562.001", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", "score": 12, "showSubtechniques": false }, - { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1063", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" - }, - { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" - }, { "techniqueID": "T1562.001", "score": 9, @@ -133423,7 +129996,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -133449,9 +130022,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -133484,7 +130056,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -133510,9 +130082,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -133545,7 +130116,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -133571,9 +130142,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -133606,7 +130176,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -133632,9 +130202,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -133667,7 +130236,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -133693,9 +130262,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -133728,7 +130296,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -133754,9 +130322,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -133789,7 +130356,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -133815,9 +130382,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -133850,7 +130416,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -133876,9 +130442,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -133911,7 +130476,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -133937,9 +130502,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -133972,7 +130536,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -133998,9 +130562,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -134033,7 +130596,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -134059,9 +130622,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -134094,7 +130656,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -134120,9 +130682,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -134155,7 +130716,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -134181,9 +130742,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -134216,7 +130776,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -134242,9 +130802,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -134277,7 +130836,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -134303,9 +130862,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -134338,7 +130896,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -134364,9 +130922,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -134399,7 +130956,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -134425,9 +130982,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -134460,7 +131016,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -134486,9 +131042,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -134521,7 +131076,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -134547,9 +131102,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -134582,7 +131136,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -134608,9 +131162,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -134643,7 +131196,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -134669,9 +131222,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -134704,7 +131256,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -134730,9 +131282,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -134765,7 +131316,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -134791,9 +131342,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -134826,7 +131376,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -134852,9 +131402,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -134887,7 +131436,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -134913,9 +131462,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -134948,7 +131496,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -134974,9 +131522,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -135009,7 +131556,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -135035,9 +131582,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -135070,7 +131616,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -135096,9 +131642,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -135131,7 +131676,7 @@ "techniqueID": "T1190", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_zerologon_via_zeek.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { "techniqueID": "T1555", @@ -135157,9 +131702,8 @@ }, { "techniqueID": "T1041", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_snicat_sni_exfiltration.yml" + "score": 12, + "showSubtechniques": false }, { "techniqueID": "T1562.001", @@ -135173,1203 +131717,2403 @@ "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", + "techniqueID": "T1190", "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { @@ -140453,1203 +138197,1203 @@ "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { @@ -141659,8 +139403,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141674,8 +139419,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141689,8 +139435,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141704,8 +139451,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141719,8 +139467,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141734,8 +139483,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141749,8 +139499,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141764,8 +139515,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141779,8 +139531,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141794,8 +139547,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141809,8 +139563,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141824,8 +139579,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141839,8 +139595,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141854,8 +139611,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141869,8 +139627,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141884,8 +139643,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141899,8 +139659,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141914,8 +139675,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141929,8 +139691,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141944,8 +139707,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141959,8 +139723,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141974,8 +139739,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -141989,8 +139755,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142004,8 +139771,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142019,8 +139787,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142034,8 +139803,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142049,8 +139819,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142064,8 +139835,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142079,8 +139851,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142094,8 +139867,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142109,8 +139883,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142124,8 +139899,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142139,8 +139915,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142154,8 +139931,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142169,8 +139947,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142184,8 +139963,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142199,8 +139979,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142214,8 +139995,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142229,8 +140011,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142244,8 +140027,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142259,8 +140043,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142274,8 +140059,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142289,8 +140075,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142304,8 +140091,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142319,8 +140107,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142334,8 +140123,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142349,8 +140139,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142364,8 +140155,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142379,8 +140171,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142394,8 +140187,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142409,8 +140203,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142424,8 +140219,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142439,8 +140235,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142454,8 +140251,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142469,8 +140267,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142484,8 +140283,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142499,8 +140299,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142514,8 +140315,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142529,8 +140331,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142544,8 +140347,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142559,8 +140363,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142574,8 +140379,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142589,8 +140395,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142604,8 +140411,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142619,8 +140427,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142634,8 +140443,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142649,8 +140459,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142664,8 +140475,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142679,8 +140491,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142694,8 +140507,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142709,8 +140523,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142724,8 +140539,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142739,8 +140555,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142754,8 +140571,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142769,8 +140587,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142784,8 +140603,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142799,8 +140619,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142814,8 +140635,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142829,8 +140651,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142844,8 +140667,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142859,8 +140683,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142874,8 +140699,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142889,8 +140715,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142904,8 +140731,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142919,8 +140747,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142934,8 +140763,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142949,8 +140779,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142964,8 +140795,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142979,8 +140811,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -142994,8 +140827,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143009,8 +140843,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143024,8 +140859,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143039,8 +140875,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143054,8 +140891,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143069,8 +140907,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143084,8 +140923,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143099,8 +140939,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143114,8 +140955,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143129,8 +140971,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143144,8 +140987,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143159,8 +141003,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143174,8 +141019,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143189,8 +141035,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143204,8 +141051,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143219,8 +141067,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143234,8 +141083,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143249,8 +141099,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143264,8 +141115,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143279,8 +141131,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143294,8 +141147,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143309,8 +141163,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143324,8 +141179,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143339,8 +141195,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143354,8 +141211,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143369,8 +141227,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143384,8 +141243,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143399,8 +141259,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143414,8 +141275,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143429,8 +141291,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143444,8 +141307,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143459,8 +141323,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143474,8 +141339,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143489,8 +141355,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143504,8 +141371,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143519,8 +141387,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143534,8 +141403,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143549,8 +141419,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143564,8 +141435,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143579,8 +141451,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143594,8 +141467,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143609,8 +141483,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143624,8 +141499,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143639,8 +141515,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143654,8 +141531,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143669,8 +141547,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143684,8 +141563,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143699,8 +141579,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143714,8 +141595,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143729,8 +141611,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143744,8 +141627,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143759,8 +141643,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143774,8 +141659,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143789,8 +141675,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143804,8 +141691,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143819,8 +141707,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143834,8 +141723,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143849,8 +141739,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143864,8 +141755,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143879,8 +141771,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143894,8 +141787,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143909,8 +141803,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143924,8 +141819,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143939,8 +141835,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143954,8 +141851,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143969,8 +141867,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143984,8 +141883,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -143999,8 +141899,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144014,8 +141915,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144029,8 +141931,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144044,8 +141947,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144059,8 +141963,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144074,8 +141979,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144089,8 +141995,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144104,8 +142011,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144119,8 +142027,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144134,8 +142043,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144149,8 +142059,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144164,8 +142075,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144179,8 +142091,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144194,8 +142107,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144209,8 +142123,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144224,8 +142139,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144239,8 +142155,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144254,8 +142171,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144269,8 +142187,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144284,8 +142203,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144299,8 +142219,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144314,8 +142235,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144329,8 +142251,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144344,8 +142267,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144359,8 +142283,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144374,8 +142299,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144389,8 +142315,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144404,8 +142331,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144419,8 +142347,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144434,8 +142363,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144449,8 +142379,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144464,8 +142395,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144479,8 +142411,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144494,8 +142427,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144509,8 +142443,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144524,8 +142459,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144539,8 +142475,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144554,8 +142491,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144569,8 +142507,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144584,8 +142523,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144599,8 +142539,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144614,8 +142555,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144629,8 +142571,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144644,8 +142587,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144659,8 +142603,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144674,8 +142619,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144689,8 +142635,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144704,8 +142651,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144719,8 +142667,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144734,8 +142683,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144749,8 +142699,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144764,8 +142715,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144779,8 +142731,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144794,8 +142747,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144809,8 +142763,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144824,8 +142779,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144839,8 +142795,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144854,8 +142811,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144869,8 +142827,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144884,8 +142843,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144899,8 +142859,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144914,8 +142875,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144929,8 +142891,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144944,8 +142907,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144959,8 +142923,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144974,8 +142939,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -144989,8 +142955,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145004,8 +142971,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145019,8 +142987,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145034,8 +143003,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145049,8 +143019,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145064,8 +143035,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145079,8 +143051,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145094,8 +143067,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145109,8 +143083,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145124,8 +143099,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145139,8 +143115,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145154,8 +143131,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145169,8 +143147,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145184,8 +143163,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145199,8 +143179,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145214,8 +143195,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145229,8 +143211,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145244,8 +143227,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145259,8 +143243,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145274,8 +143259,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145289,8 +143275,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145304,8 +143291,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145319,8 +143307,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145334,8 +143323,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145349,8 +143339,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145364,8 +143355,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145379,8 +143371,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145394,8 +143387,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145409,8 +143403,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145424,8 +143419,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145439,8 +143435,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145454,8 +143451,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145469,8 +143467,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145484,8 +143483,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145499,8 +143499,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145514,8 +143515,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145529,8 +143531,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145544,8 +143547,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145559,8 +143563,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145574,8 +143579,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145589,8 +143595,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145604,8 +143611,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145619,8 +143627,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145634,8 +143643,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145649,8 +143659,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145664,8 +143675,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145679,8 +143691,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145694,8 +143707,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145709,8 +143723,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145724,8 +143739,9 @@ }, { "techniqueID": "T1505.003", - "score": 10, - "showSubtechniques": false + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { "techniqueID": "T1100", @@ -145733,1011 +143749,1283 @@ "showSubtechniques": false }, { - "techniqueID": "T1143", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1559.002", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1135", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "techniqueID": "T1119", + "score": 10, + "showSubtechniques": false }, { - "techniqueID": "T1090.002", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", - "score": 8, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": false }, { - "techniqueID": "T1102.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1564.003", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1035", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1143", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1559.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1135", - "score": 6, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", - "score": 8, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": false }, { - "techniqueID": "T1102.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1564.003", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1035", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1143", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1559.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1135", - "score": 6, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", - "score": 8, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": false }, { - "techniqueID": "T1102.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1564.003", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1035", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1143", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1559.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1135", - "score": 6, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", - "score": 8, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": false }, { - "techniqueID": "T1102.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1564.003", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1035", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1143", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1559.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1135", - "score": 6, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", - "score": 8, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": false }, { - "techniqueID": "T1102.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1564.003", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1035", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1143", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1559.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1135", - "score": 6, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", - "score": 8, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": false }, { - "techniqueID": "T1102.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1564.003", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1035", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1143", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1559.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1135", - "score": 6, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", - "score": 8, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": false }, { - "techniqueID": "T1102.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1564.003", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1035", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1143", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1559.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1135", - "score": 6, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", - "score": 8, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": false }, { - "techniqueID": "T1102.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1564.003", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1035", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1143", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1559.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1135", - "score": 6, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", - "score": 8, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": false }, { - "techniqueID": "T1102.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1564.003", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1035", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1143", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1559.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1135", - "score": 6, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", - "score": 8, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": false }, { - "techniqueID": "T1102.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1564.003", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1035", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1143", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1559.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1135", - "score": 6, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", - "score": 8, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": false }, { - "techniqueID": "T1102.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1564.003", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1035", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1143", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1559.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1135", - "score": 6, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", - "score": 8, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": false }, { - "techniqueID": "T1102.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1564.003", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1035", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1143", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1559.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1135", - "score": 6, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", - "score": 8, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": false }, { - "techniqueID": "T1102.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1564.003", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1035", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1143", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1559.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1135", - "score": 6, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", - "score": 8, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": false }, { - "techniqueID": "T1102.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1564.003", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1035", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1143", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1559.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1135", - "score": 6, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", - "score": 8, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": false }, { - "techniqueID": "T1102.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1564.003", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1035", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1143", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1559.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1135", - "score": 6, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", - "score": 8, + "techniqueID": "T1505.003", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + "techniqueID": "T1100", + "score": 10, + "showSubtechniques": false }, { - "techniqueID": "T1102.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1564.003", + "techniqueID": "T1505.003", "score": 9, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1035", + "techniqueID": "T1505.003", "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" + }, + { + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { @@ -167909,520 +166197,1012 @@ "showSubtechniques": false }, { - "techniqueID": "T1132.001", - "score": 8, + "techniqueID": "T1143", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1059.007", - "score": 8, + "techniqueID": "T1559.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1590.002", - "score": 8, + "techniqueID": "T1135", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1090.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1548.002", - "score": 5, + "techniqueID": "T1036.004", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1110", + "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, { - "techniqueID": "T1071.004", - "score": 6, + "techniqueID": "T1068", + "score": 0, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" }, { - "techniqueID": "T1003.004", - "score": 8, + "techniqueID": "T1102.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1137", - "score": 8, + "techniqueID": "T1564.003", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1106", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": false }, { - "techniqueID": "T1219", - "score": 8, + "techniqueID": "T1569.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1117", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml" + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false }, { - "techniqueID": "T1090", - "score": 8, + "techniqueID": "T1143", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1102", - "score": 8, + "techniqueID": "T1559.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1218.010", + "techniqueID": "T1135", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1065", - "score": 8, + "techniqueID": "T1090.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1088", - "score": 8, + "techniqueID": "T1036.004", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1048.003", - "score": 4, + "techniqueID": "T1110", + "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, { - "techniqueID": "T1132.001", - "score": 8, + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1059.007", - "score": 8, + "techniqueID": "T1564.003", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1590.002", - "score": 8, + "techniqueID": "T1173", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1548.002", - "score": 5, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml" + "techniqueID": "T1569.002", + "score": 9, + "showSubtechniques": false }, { - "techniqueID": "T1071.004", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false }, { - "techniqueID": "T1003.004", - "score": 8, + "techniqueID": "T1143", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1137", - "score": 8, + "techniqueID": "T1559.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1106", + "techniqueID": "T1135", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1219", - "score": 8, + "techniqueID": "T1090.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1117", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml" + "techniqueID": "T1036.004", + "score": 9, + "showSubtechniques": false }, { - "techniqueID": "T1090", + "techniqueID": "T1110", "score": 8, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + }, + { + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1102", - "score": 8, + "techniqueID": "T1564.003", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1218.010", + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1569.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1065", - "score": 8, + "techniqueID": "T1090.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1088", - "score": 8, + "techniqueID": "T1036.004", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1048.003", - "score": 4, + "techniqueID": "T1110", + "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, { - "techniqueID": "T1132.001", - "score": 8, + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1059.007", - "score": 8, + "techniqueID": "T1564.003", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1590.002", - "score": 8, + "techniqueID": "T1173", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1548.002", - "score": 5, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml" + "techniqueID": "T1569.002", + "score": 9, + "showSubtechniques": false }, { - "techniqueID": "T1071.004", + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1003.004", - "score": 8, + "techniqueID": "T1090.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1137", + "techniqueID": "T1036.004", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1110", "score": 8, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + }, + { + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1106", + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1569.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1219", - "score": 8, + "techniqueID": "T1090.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1117", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml" + "techniqueID": "T1036.004", + "score": 9, + "showSubtechniques": false }, { - "techniqueID": "T1090", + "techniqueID": "T1110", "score": 8, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + }, + { + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1102", - "score": 8, + "techniqueID": "T1564.003", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1218.010", + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1569.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1065", - "score": 8, + "techniqueID": "T1090.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1088", - "score": 8, + "techniqueID": "T1036.004", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1048.003", - "score": 4, + "techniqueID": "T1110", + "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, { - "techniqueID": "T1132.001", - "score": 8, + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1059.007", - "score": 8, + "techniqueID": "T1564.003", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1590.002", - "score": 8, + "techniqueID": "T1173", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1548.002", - "score": 5, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml" + "techniqueID": "T1569.002", + "score": 9, + "showSubtechniques": false }, { - "techniqueID": "T1071.004", + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1003.004", - "score": 8, + "techniqueID": "T1090.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1137", + "techniqueID": "T1036.004", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1110", "score": 8, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + }, + { + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1106", + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1569.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1219", - "score": 8, + "techniqueID": "T1090.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1117", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml" + "techniqueID": "T1036.004", + "score": 9, + "showSubtechniques": false }, { - "techniqueID": "T1090", + "techniqueID": "T1110", "score": 8, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + }, + { + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1102", - "score": 8, + "techniqueID": "T1564.003", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1218.010", + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1569.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1065", - "score": 8, + "techniqueID": "T1090.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1088", - "score": 8, + "techniqueID": "T1036.004", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1048.003", - "score": 4, + "techniqueID": "T1110", + "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, { - "techniqueID": "T1132.001", - "score": 8, + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1059.007", - "score": 8, + "techniqueID": "T1564.003", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1590.002", - "score": 8, + "techniqueID": "T1173", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1548.002", - "score": 5, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml" + "techniqueID": "T1569.002", + "score": 9, + "showSubtechniques": false }, { - "techniqueID": "T1071.004", + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1003.004", - "score": 8, + "techniqueID": "T1090.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1137", + "techniqueID": "T1036.004", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1110", "score": 8, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + }, + { + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1106", + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1569.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1219", - "score": 8, + "techniqueID": "T1090.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1117", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml" + "techniqueID": "T1036.004", + "score": 9, + "showSubtechniques": false }, { - "techniqueID": "T1090", + "techniqueID": "T1110", "score": 8, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + }, + { + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1102", - "score": 8, + "techniqueID": "T1564.003", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1218.010", + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1569.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1065", - "score": 8, + "techniqueID": "T1090.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1088", - "score": 8, + "techniqueID": "T1036.004", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1048.003", - "score": 4, + "techniqueID": "T1110", + "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" }, { - "techniqueID": "T1132.001", - "score": 8, + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1059.007", - "score": 8, + "techniqueID": "T1564.003", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1590.002", - "score": 8, + "techniqueID": "T1173", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1548.002", - "score": 5, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml" + "techniqueID": "T1569.002", + "score": 9, + "showSubtechniques": false }, { - "techniqueID": "T1071.004", + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1003.004", - "score": 8, + "techniqueID": "T1090.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1137", + "techniqueID": "T1036.004", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1110", "score": 8, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + }, + { + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1106", + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1569.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1219", - "score": 8, + "techniqueID": "T1090.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1117", - "score": 7, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml" + "techniqueID": "T1036.004", + "score": 9, + "showSubtechniques": false }, { - "techniqueID": "T1090", + "techniqueID": "T1110", "score": 8, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + }, + { + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1102", - "score": 8, + "techniqueID": "T1564.003", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1218.010", + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1569.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1065", - "score": 8, + "techniqueID": "T1090.002", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1088", - "score": 8, + "techniqueID": "T1036.004", + "score": 9, "showSubtechniques": false }, { - "techniqueID": "T1048.003", - "score": 4, + "techniqueID": "T1110", + "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + }, + { + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1569.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false }, { "techniqueID": "T1132.001", @@ -168449,7 +167229,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -168535,7 +167315,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -168621,7 +167401,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -168707,7 +167487,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -168793,7 +167573,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -168879,7 +167659,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -168965,7 +167745,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -169051,7 +167831,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -169137,7 +167917,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -169223,7 +168003,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -169309,7 +168089,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -169395,7 +168175,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -169481,7 +168261,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -169567,7 +168347,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -169653,7 +168433,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -169739,7 +168519,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -169825,7 +168605,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -169911,7 +168691,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -169997,7 +168777,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -170083,7 +168863,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -170169,7 +168949,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -170255,7 +169035,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -170341,7 +169121,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -170427,7 +169207,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -170513,7 +169293,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -170599,7 +169379,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -170685,7 +169465,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -170771,7 +169551,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -170857,7 +169637,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -170943,7 +169723,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -171029,7 +169809,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -171115,7 +169895,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -171201,7 +169981,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -171287,7 +170067,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -171373,7 +170153,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -171459,7 +170239,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -171545,7 +170325,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -171631,7 +170411,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -171717,7 +170497,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -171803,7 +170583,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -171889,7 +170669,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -171975,7 +170755,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -172061,7 +170841,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -172147,7 +170927,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -172233,7 +171013,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -172319,7 +171099,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -172405,7 +171185,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -172491,7 +171271,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -172577,7 +171357,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -172663,7 +171443,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -172749,7 +171529,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -172835,7 +171615,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -172921,7 +171701,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -173007,7 +171787,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -173093,7 +171873,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -173179,7 +171959,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -173265,7 +172045,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -173351,7 +172131,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -173437,7 +172217,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -173523,7 +172303,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -173609,7 +172389,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -173695,7 +172475,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -173781,7 +172561,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -173867,7 +172647,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -173953,7 +172733,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -174039,7 +172819,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -174125,7 +172905,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -174211,7 +172991,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -174297,7 +173077,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -174383,7 +173163,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -174469,7 +173249,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -174555,7 +173335,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -174641,7 +173421,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -174727,7 +173507,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -174813,7 +173593,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -174899,7 +173679,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -174985,7 +173765,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -175071,7 +173851,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -175157,7 +173937,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -175243,7 +174023,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -175329,7 +174109,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -175415,7 +174195,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -175501,7 +174281,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -175587,7 +174367,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -175673,7 +174453,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -175759,7 +174539,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -175845,7 +174625,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -175931,7 +174711,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -176017,7 +174797,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -176103,7 +174883,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -176189,7 +174969,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -176275,7 +175055,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -176361,7 +175141,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -176447,7 +175227,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -176533,7 +175313,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -176619,7 +175399,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -176705,7 +175485,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -176791,7 +175571,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -176877,7 +175657,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -176963,7 +175743,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -177049,7 +175829,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -177135,7 +175915,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -177221,7 +176001,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -177307,7 +176087,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -177393,7 +176173,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -177479,7 +176259,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -177565,7 +176345,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -177651,7 +176431,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -177737,7 +176517,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -177823,7 +176603,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -177909,7 +176689,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -177995,7 +176775,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -178081,7 +176861,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -178167,7 +176947,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -178253,7 +177033,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -178339,7 +177119,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -178425,7 +177205,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -178511,7 +177291,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -178597,7 +177377,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -178683,7 +177463,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -178769,7 +177549,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -178855,7 +177635,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -178941,7 +177721,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -179027,7 +177807,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -179113,7 +177893,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -179199,7 +177979,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -179285,7 +178065,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -179371,7 +178151,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -179457,7 +178237,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -179543,7 +178323,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -179629,7 +178409,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -179715,7 +178495,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -179801,7 +178581,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -179887,7 +178667,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -179973,7 +178753,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -180059,7 +178839,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -180145,7 +178925,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -180231,7 +179011,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -180317,7 +179097,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -180403,7 +179183,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -180489,7 +179269,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -180575,7 +179355,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -180661,7 +179441,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -180747,7 +179527,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -180833,7 +179613,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -180919,7 +179699,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -181005,7 +179785,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -181091,7 +179871,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -181177,7 +179957,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -181263,7 +180043,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -181349,7 +180129,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -181435,7 +180215,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -181521,7 +180301,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -181607,7 +180387,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -181693,7 +180473,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -181779,7 +180559,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -181865,7 +180645,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -181951,7 +180731,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -182037,7 +180817,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -182123,7 +180903,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -182209,7 +180989,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -182295,7 +181075,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -182381,7 +181161,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -182467,7 +181247,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -182553,7 +181333,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -182639,7 +181419,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -182725,7 +181505,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -182811,7 +181591,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -182897,7 +181677,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -182983,7 +181763,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -183069,7 +181849,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -183155,7 +181935,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -183241,7 +182021,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -183327,7 +182107,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -183413,7 +182193,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -183499,7 +182279,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -183585,7 +182365,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -183671,7 +182451,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -183757,7 +182537,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -183843,7 +182623,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -183929,7 +182709,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -184015,7 +182795,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -184101,7 +182881,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -184187,7 +182967,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -184273,7 +183053,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -184359,7 +183139,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -184445,7 +183225,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -184531,7 +183311,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -184617,7 +183397,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -184703,7 +183483,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -184789,7 +183569,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -184875,7 +183655,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -184961,7 +183741,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -185047,7 +183827,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -185133,7 +183913,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -185219,7 +183999,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -185305,7 +184085,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -185391,7 +184171,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -185477,7 +184257,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -185563,7 +184343,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -185649,7 +184429,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -185735,7 +184515,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -185821,7 +184601,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -185907,7 +184687,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -185993,7 +184773,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -186079,7 +184859,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -186165,7 +184945,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -186251,7 +185031,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -186337,7 +185117,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -186423,7 +185203,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -186509,7 +185289,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -186595,7 +185375,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -186681,7 +185461,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -186767,7 +185547,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -186853,7 +185633,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -186939,7 +185719,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -187025,7 +185805,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -187111,7 +185891,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -187197,7 +185977,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -187283,7 +186063,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -187369,7 +186149,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -187455,7 +186235,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -187541,7 +186321,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -187627,7 +186407,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -187713,7 +186493,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -187799,7 +186579,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -187885,7 +186665,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -187971,7 +186751,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -188057,7 +186837,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -188143,7 +186923,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -188229,7 +187009,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -188315,7 +187095,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -188401,7 +187181,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -188487,7 +187267,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -188573,7 +187353,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -188659,7 +187439,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -188745,7 +187525,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -188831,7 +187611,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -188917,7 +187697,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -189003,7 +187783,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -189089,7 +187869,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -189175,7 +187955,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -189261,7 +188041,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -189347,7 +188127,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -189433,7 +188213,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -189519,7 +188299,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -189605,7 +188385,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -189691,7 +188471,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -189777,7 +188557,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -189863,7 +188643,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -189949,7 +188729,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -190035,7 +188815,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -190121,7 +188901,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -190207,7 +188987,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -190293,7 +189073,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -190379,7 +189159,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -190465,7 +189245,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -190551,7 +189331,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -190637,7 +189417,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -190723,7 +189503,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -190809,7 +189589,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -190895,7 +189675,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -190981,7 +189761,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -191067,7 +189847,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -191153,7 +189933,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -191239,7 +190019,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -191325,7 +190105,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -191411,7 +190191,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -191497,7 +190277,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -191583,7 +190363,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -191669,7 +190449,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -191755,7 +190535,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -191841,7 +190621,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -191927,7 +190707,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -192013,7 +190793,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -192099,7 +190879,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -192185,7 +190965,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -192271,7 +191051,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -192357,7 +191137,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -192443,7 +191223,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -192529,7 +191309,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -192615,7 +191395,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -192701,7 +191481,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -192787,7 +191567,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -192873,7 +191653,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -192959,7 +191739,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -193045,7 +191825,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -193131,7 +191911,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -193217,7 +191997,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -193303,7 +192083,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -193389,7 +192169,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -193475,7 +192255,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -193561,7 +192341,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -193647,7 +192427,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -193733,7 +192513,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -193819,7 +192599,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -193905,7 +192685,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -193991,7 +192771,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -194077,7 +192857,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -194163,7 +192943,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -194249,7 +193029,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -194335,7 +193115,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -194421,7 +193201,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -194507,7 +193287,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -194593,7 +193373,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -194679,7 +193459,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -194765,7 +193545,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -194851,7 +193631,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -194937,7 +193717,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -195023,7 +193803,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -195109,7 +193889,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -195195,7 +193975,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -195281,7 +194061,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -195367,7 +194147,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -195453,7 +194233,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -195539,7 +194319,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -195625,7 +194405,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -195711,7 +194491,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -195797,7 +194577,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -195883,7 +194663,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -195969,7 +194749,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -196055,7 +194835,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -196141,7 +194921,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -196227,7 +195007,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -196313,7 +195093,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -196399,7 +195179,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -196485,7 +195265,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -196571,7 +195351,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -196657,7 +195437,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -196743,7 +195523,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -196829,7 +195609,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -196915,7 +195695,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -197001,7 +195781,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -197087,7 +195867,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -197173,7 +195953,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -197259,7 +196039,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -197345,7 +196125,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -197431,7 +196211,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -197517,7 +196297,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -197603,7 +196383,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -197689,7 +196469,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -197775,7 +196555,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -197861,7 +196641,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -197947,7 +196727,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -198033,7 +196813,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -198119,7 +196899,7 @@ "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_outliers___mltk.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { "techniqueID": "T1003.004", @@ -198181,328 +196961,520 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" }, { - "techniqueID": "T1066", - "score": 7, + "techniqueID": "T1132.001", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1003.002", + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 5, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml" + }, + { + "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { - "techniqueID": "T1587.001", - "score": 7, + "techniqueID": "T1003.004", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1573.001", - "score": 7, + "techniqueID": "T1137", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1069.002", - "score": 7, + "techniqueID": "T1106", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1219", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1021.004", + "techniqueID": "T1117", "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml" + }, + { + "techniqueID": "T1090", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1007", - "score": 5, + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { - "techniqueID": "T1071", - "score": 7, + "techniqueID": "T1065", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1547.009", - "score": 7, + "techniqueID": "T1088", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1070.001", - "score": 5, + "techniqueID": "T1048.003", + "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" }, { - "techniqueID": "T1588.001", - "score": 7, + "techniqueID": "T1132.001", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1070", + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml" }, { - "techniqueID": "T1552.001", - "score": 7, + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1023", - "score": 7, + "techniqueID": "T1137", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1098", - "score": -5, + "techniqueID": "T1106", + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { - "techniqueID": "T1027.005", - "score": 7, + "techniqueID": "T1219", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1114.002", - "score": 6, + "techniqueID": "T1117", + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml" }, { - "techniqueID": "T1012", + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { - "techniqueID": "T1221", - "score": 7, + "techniqueID": "T1065", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1134", - "score": 3, + "techniqueID": "T1088", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1048.003", + "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" }, { - "techniqueID": "T1066", - "score": 7, + "techniqueID": "T1132.001", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1003.002", + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 5, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml" + }, + { + "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { - "techniqueID": "T1587.001", - "score": 7, + "techniqueID": "T1003.004", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1573.001", - "score": 7, + "techniqueID": "T1137", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1069.002", - "score": 7, + "techniqueID": "T1106", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1219", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1021.004", + "techniqueID": "T1117", "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml" + }, + { + "techniqueID": "T1090", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1007", - "score": 5, + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { - "techniqueID": "T1071", - "score": 7, + "techniqueID": "T1065", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1547.009", - "score": 7, + "techniqueID": "T1088", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1070.001", - "score": 5, + "techniqueID": "T1048.003", + "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" }, { - "techniqueID": "T1588.001", - "score": 7, + "techniqueID": "T1132.001", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1070", + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml" }, { - "techniqueID": "T1552.001", - "score": 7, + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1023", - "score": 7, + "techniqueID": "T1137", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1098", - "score": -5, + "techniqueID": "T1106", + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { - "techniqueID": "T1027.005", - "score": 7, + "techniqueID": "T1219", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1114.002", - "score": 6, + "techniqueID": "T1117", + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml" }, { - "techniqueID": "T1012", + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { - "techniqueID": "T1221", - "score": 7, + "techniqueID": "T1065", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1134", - "score": 3, + "techniqueID": "T1088", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1048.003", + "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" }, { - "techniqueID": "T1066", - "score": 7, + "techniqueID": "T1132.001", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1003.002", + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", + "score": 5, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml" + }, + { + "techniqueID": "T1071.004", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" }, { - "techniqueID": "T1587.001", - "score": 7, + "techniqueID": "T1003.004", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1573.001", - "score": 7, + "techniqueID": "T1137", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1069.002", - "score": 7, + "techniqueID": "T1106", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1219", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1021.004", + "techniqueID": "T1117", "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml" + }, + { + "techniqueID": "T1090", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1007", - "score": 5, + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { - "techniqueID": "T1071", - "score": 7, + "techniqueID": "T1065", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1547.009", - "score": 7, + "techniqueID": "T1088", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1070.001", - "score": 5, + "techniqueID": "T1048.003", + "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" }, { - "techniqueID": "T1588.001", - "score": 7, + "techniqueID": "T1132.001", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1070", + "techniqueID": "T1059.007", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1590.002", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1548.002", "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml" }, { - "techniqueID": "T1552.001", - "score": 7, + "techniqueID": "T1071.004", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml" + }, + { + "techniqueID": "T1003.004", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1023", - "score": 7, + "techniqueID": "T1137", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1098", - "score": -5, + "techniqueID": "T1106", + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { - "techniqueID": "T1027.005", - "score": 7, + "techniqueID": "T1219", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1114.002", - "score": 6, + "techniqueID": "T1117", + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml" }, { - "techniqueID": "T1012", + "techniqueID": "T1090", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1102", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.010", "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml" }, { - "techniqueID": "T1221", - "score": 7, + "techniqueID": "T1065", + "score": 8, "showSubtechniques": false }, { - "techniqueID": "T1134", - "score": 3, + "techniqueID": "T1088", + "score": 8, + "showSubtechniques": false + }, + { + "techniqueID": "T1048.003", + "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml" }, { "techniqueID": "T1066", @@ -236197,286 +235169,328 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml" }, { - "techniqueID": "T1037", - "score": 6, + "techniqueID": "T1066", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1099", + "techniqueID": "T1003.002", "score": 6, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" }, { - "techniqueID": "T1069", - "score": 6, + "techniqueID": "T1587.001", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1074.002", - "score": 6, + "techniqueID": "T1573.001", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1070.006", - "score": 6, + "techniqueID": "T1069.002", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1009", - "score": 6, + "techniqueID": "T1021.004", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1562.004", - "score": 4, + "techniqueID": "T1007", + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1027.001", - "score": 6, + "techniqueID": "T1071", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1218.005", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml" + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": false }, { - "techniqueID": "T1546.003", + "techniqueID": "T1070.001", "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml" }, { - "techniqueID": "T1170", - "score": 6, + "techniqueID": "T1588.001", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1027.003", - "score": 6, - "showSubtechniques": false + "techniqueID": "T1070", + "score": 5, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml" }, { - "techniqueID": "T1059.006", - "score": 6, + "techniqueID": "T1552.001", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1194", - "score": 6, + "techniqueID": "T1023", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1084", - "score": 6, + "techniqueID": "T1098", + "score": -5, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1027.005", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1001.002", + "techniqueID": "T1114.002", "score": 6, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml" }, { - "techniqueID": "T1055.001", + "techniqueID": "T1012", "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1221", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1566.003", - "score": 5, + "techniqueID": "T1134", + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml" }, { - "techniqueID": "T1037", - "score": 6, + "techniqueID": "T1066", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1099", + "techniqueID": "T1003.002", "score": 6, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" }, { - "techniqueID": "T1069", - "score": 6, + "techniqueID": "T1587.001", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1074.002", - "score": 6, + "techniqueID": "T1573.001", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1070.006", - "score": 6, + "techniqueID": "T1069.002", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1009", - "score": 6, + "techniqueID": "T1021.004", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1562.004", - "score": 4, + "techniqueID": "T1007", + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1027.001", - "score": 6, + "techniqueID": "T1071", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1218.005", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml" + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": false }, { - "techniqueID": "T1546.003", + "techniqueID": "T1070.001", "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml" }, { - "techniqueID": "T1170", - "score": 6, + "techniqueID": "T1588.001", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1027.003", - "score": 6, - "showSubtechniques": false + "techniqueID": "T1070", + "score": 5, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml" }, { - "techniqueID": "T1059.006", - "score": 6, + "techniqueID": "T1552.001", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1194", - "score": 6, + "techniqueID": "T1023", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1084", - "score": 6, + "techniqueID": "T1098", + "score": -5, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1027.005", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1001.002", + "techniqueID": "T1114.002", "score": 6, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml" }, { - "techniqueID": "T1055.001", + "techniqueID": "T1012", "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1221", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1566.003", - "score": 5, + "techniqueID": "T1134", + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml" }, { - "techniqueID": "T1037", - "score": 6, + "techniqueID": "T1066", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1099", + "techniqueID": "T1003.002", "score": 6, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml" }, { - "techniqueID": "T1069", - "score": 6, + "techniqueID": "T1587.001", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1074.002", - "score": 6, + "techniqueID": "T1573.001", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1070.006", - "score": 6, + "techniqueID": "T1069.002", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1009", - "score": 6, + "techniqueID": "T1021.004", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1562.004", - "score": 4, + "techniqueID": "T1007", + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1027.001", - "score": 6, + "techniqueID": "T1071", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1218.005", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml" + "techniqueID": "T1547.009", + "score": 7, + "showSubtechniques": false }, { - "techniqueID": "T1546.003", + "techniqueID": "T1070.001", "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml" }, { - "techniqueID": "T1170", - "score": 6, + "techniqueID": "T1588.001", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1027.003", - "score": 6, - "showSubtechniques": false + "techniqueID": "T1070", + "score": 5, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml" }, { - "techniqueID": "T1059.006", - "score": 6, + "techniqueID": "T1552.001", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1194", - "score": 6, + "techniqueID": "T1023", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1084", - "score": 6, + "techniqueID": "T1098", + "score": -5, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1027.005", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1001.002", + "techniqueID": "T1114.002", "score": 6, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml" }, { - "techniqueID": "T1055.001", + "techniqueID": "T1012", "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1221", + "score": 7, "showSubtechniques": false }, { - "techniqueID": "T1566.003", - "score": 5, + "techniqueID": "T1134", + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml" }, { "techniqueID": "T1037", @@ -269285,208 +268299,286 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" }, { - "techniqueID": "T1040", - "score": 5, + "techniqueID": "T1037", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1120", - "score": 5, + "techniqueID": "T1099", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1550", - "score": 5, + "techniqueID": "T1069", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1546.008", + "techniqueID": "T1074.002", + "score": 6, + "showSubtechniques": false + }, + { + "techniqueID": "T1070.006", + "score": 6, + "showSubtechniques": false + }, + { + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.004", "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml" }, { - "techniqueID": "T1087", - "score": 1, + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.005", + "score": 0, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml" }, { - "techniqueID": "T1020", + "techniqueID": "T1546.003", "score": 5, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1170", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1015", - "score": 5, + "techniqueID": "T1027.003", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1566", - "score": 5, + "techniqueID": "T1059.006", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1218.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + "techniqueID": "T1194", + "score": 6, + "showSubtechniques": false }, { - "techniqueID": "T1195.002", - "score": 5, + "techniqueID": "T1084", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1573.002", - "score": 5, + "techniqueID": "T1001.002", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1075", - "score": 5, + "techniqueID": "T1055.001", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1078.002", - "score": 3, + "techniqueID": "T1566.003", + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" }, { - "techniqueID": "T1223", - "score": 5, + "techniqueID": "T1037", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1158", - "score": 5, + "techniqueID": "T1099", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1550.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" + "techniqueID": "T1069", + "score": 6, + "showSubtechniques": false }, { - "techniqueID": "T1564.001", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "techniqueID": "T1074.002", + "score": 6, + "showSubtechniques": false }, { - "techniqueID": "T1102.001", - "score": 5, + "techniqueID": "T1070.006", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1078.003", + "techniqueID": "T1009", + "score": 6, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.004", "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml" }, { - "techniqueID": "T1040", - "score": 5, + "techniqueID": "T1027.001", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1120", + "techniqueID": "T1218.005", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml" + }, + { + "techniqueID": "T1546.003", "score": 5, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1170", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1550", - "score": 5, + "techniqueID": "T1027.003", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1546.008", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" + "techniqueID": "T1059.006", + "score": 6, + "showSubtechniques": false }, { - "techniqueID": "T1087", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" + "techniqueID": "T1194", + "score": 6, + "showSubtechniques": false }, { - "techniqueID": "T1020", - "score": 5, + "techniqueID": "T1084", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1015", - "score": 5, + "techniqueID": "T1001.002", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1566", - "score": 5, + "techniqueID": "T1055.001", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1218.001", - "score": 1, + "techniqueID": "T1566.003", + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" }, { - "techniqueID": "T1195.002", - "score": 5, + "techniqueID": "T1037", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1573.002", - "score": 5, + "techniqueID": "T1099", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1075", - "score": 5, + "techniqueID": "T1069", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1078.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + "techniqueID": "T1074.002", + "score": 6, + "showSubtechniques": false }, { - "techniqueID": "T1223", - "score": 5, + "techniqueID": "T1070.006", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1158", - "score": 5, + "techniqueID": "T1009", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1550.002", - "score": 3, + "techniqueID": "T1562.004", + "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml" }, { - "techniqueID": "T1564.001", - "score": 4, + "techniqueID": "T1027.001", + "score": 6, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.005", + "score": 0, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml" }, { - "techniqueID": "T1102.001", + "techniqueID": "T1546.003", "score": 5, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml" + }, + { + "techniqueID": "T1170", + "score": 6, "showSubtechniques": false }, { - "techniqueID": "T1078.003", - "score": 4, + "techniqueID": "T1027.003", + "score": 6, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.006", + "score": 6, + "showSubtechniques": false + }, + { + "techniqueID": "T1194", + "score": 6, + "showSubtechniques": false + }, + { + "techniqueID": "T1084", + "score": 6, + "showSubtechniques": false + }, + { + "techniqueID": "T1001.002", + "score": 6, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.001", + "score": 6, + "showSubtechniques": false + }, + { + "techniqueID": "T1566.003", + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml" }, { "techniqueID": "T1040", @@ -269527,8 +268619,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -269629,8 +268722,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -269731,8 +268825,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -269833,110 +268928,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" - }, - { - "techniqueID": "T1195.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1573.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1075", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" - }, - { - "techniqueID": "T1223", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1158", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" - }, - { - "techniqueID": "T1564.001", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" - }, - { - "techniqueID": "T1102.001", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.003", "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" - }, - { - "techniqueID": "T1040", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1120", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1546.008", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" - }, - { - "techniqueID": "T1087", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1020", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1015", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -270037,8 +269031,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -270139,8 +269134,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -270241,8 +269237,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -270343,8 +269340,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -270445,8 +269443,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -270547,8 +269546,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -270649,8 +269649,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -270751,8 +269752,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -270853,8 +269855,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -270955,8 +269958,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -271057,8 +270061,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -271159,8 +270164,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -271261,8 +270267,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -271363,8 +270370,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -271465,8 +270473,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -271567,8 +270576,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -271669,8 +270679,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -271771,8 +270782,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -271873,8 +270885,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -271975,8 +270988,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -272077,8 +271091,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -272179,8 +271194,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -272281,8 +271297,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -272383,8 +271400,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -272485,8 +271503,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -272587,8 +271606,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -272689,8 +271709,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -272791,8 +271812,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -272893,8 +271915,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -272995,8 +272018,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -273097,8 +272121,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -273199,8 +272224,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -273301,8 +272327,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -273403,8 +272430,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -273505,8 +272533,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -273607,8 +272636,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -273709,8 +272739,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -273811,8 +272842,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -273913,8 +272945,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -274015,110 +273048,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" - }, - { - "techniqueID": "T1195.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1573.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1075", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" - }, - { - "techniqueID": "T1223", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1158", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" - }, - { - "techniqueID": "T1564.001", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" - }, - { - "techniqueID": "T1102.001", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.003", "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" - }, - { - "techniqueID": "T1040", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1120", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1546.008", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" - }, - { - "techniqueID": "T1087", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1020", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1015", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -274219,8 +273151,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -274321,8 +273254,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -274423,8 +273357,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -274525,8 +273460,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -274627,8 +273563,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -274729,8 +273666,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -274831,8 +273769,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -274933,8 +273872,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -275035,8 +273975,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -275137,8 +274078,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -275239,8 +274181,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -275341,8 +274284,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -275443,8 +274387,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -275545,8 +274490,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -275647,8 +274593,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -275749,8 +274696,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -275851,8 +274799,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -275953,8 +274902,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -276055,8 +275005,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -276157,8 +275108,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -276259,8 +275211,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -276361,8 +275314,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -276463,8 +275417,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -276565,8 +275520,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -276667,8 +275623,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -276769,8 +275726,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -276871,8 +275829,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -276973,8 +275932,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -277075,8 +276035,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -277177,8 +276138,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -277279,8 +276241,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -277381,8 +276344,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -277483,8 +276447,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -277585,8 +276550,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -277687,8 +276653,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -277789,8 +276756,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -277891,8 +276859,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -277993,8 +276962,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -278095,8 +277065,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -278197,110 +277168,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" - }, - { - "techniqueID": "T1195.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1573.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1075", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" - }, - { - "techniqueID": "T1223", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1158", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" - }, - { - "techniqueID": "T1564.001", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" - }, - { - "techniqueID": "T1102.001", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.003", "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" - }, - { - "techniqueID": "T1040", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1120", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1546.008", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" - }, - { - "techniqueID": "T1087", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1020", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1015", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -278401,8 +277271,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -278503,8 +277374,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -278605,8 +277477,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -278707,8 +277580,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -278809,8 +277683,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -278911,8 +277786,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -279013,8 +277889,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -279115,8 +277992,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -279217,8 +278095,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -279319,8 +278198,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -279421,8 +278301,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -279523,8 +278404,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -279625,8 +278507,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -279727,8 +278610,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -279829,8 +278713,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -279931,8 +278816,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -280033,8 +278919,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -280135,8 +279022,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -280237,8 +279125,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -280339,8 +279228,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -280441,8 +279331,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -280543,8 +279434,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -280645,8 +279537,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -280747,8 +279640,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -280849,8 +279743,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -280951,8 +279846,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -281053,8 +279949,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -281155,8 +280052,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -281257,8 +280155,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -281359,8 +280258,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -281461,8 +280361,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -281563,8 +280464,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -281665,8 +280567,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -281767,8 +280670,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -281869,8 +280773,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -281971,8 +280876,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -282073,8 +280979,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -282175,8 +281082,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -282277,8 +281185,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -282379,110 +281288,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" - }, - { - "techniqueID": "T1195.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1573.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1075", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" - }, - { - "techniqueID": "T1223", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1158", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" - }, - { - "techniqueID": "T1564.001", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" - }, - { - "techniqueID": "T1102.001", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.003", "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" - }, - { - "techniqueID": "T1040", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1120", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1546.008", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" - }, - { - "techniqueID": "T1087", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1020", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1015", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -282583,8 +281391,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -282685,8 +281494,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -282787,8 +281597,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -282889,8 +281700,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -282991,8 +281803,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -283093,8 +281906,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -283195,8 +282009,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -283297,8 +282112,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -283399,8 +282215,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -283501,8 +282318,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -283603,8 +282421,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -283705,8 +282524,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -283807,8 +282627,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -283909,8 +282730,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -284011,8 +282833,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -284113,8 +282936,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -284215,8 +283039,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -284317,8 +283142,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -284419,8 +283245,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -284521,8 +283348,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -284623,8 +283451,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -284725,8 +283554,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -284827,8 +283657,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -284929,8 +283760,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -285031,8 +283863,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -285133,8 +283966,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -285235,8 +284069,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -285337,8 +284172,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -285439,8 +284275,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -285541,8 +284378,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -285643,8 +284481,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -285745,8 +284584,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -285847,8 +284687,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -285949,8 +284790,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -286051,8 +284893,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -286153,8 +284996,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -286255,8 +285099,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -286357,8 +285202,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -286459,8 +285305,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -286561,110 +285408,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" - }, - { - "techniqueID": "T1195.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1573.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1075", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" - }, - { - "techniqueID": "T1223", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1158", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" - }, - { - "techniqueID": "T1564.001", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" - }, - { - "techniqueID": "T1102.001", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.003", "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" - }, - { - "techniqueID": "T1040", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1120", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1546.008", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" - }, - { - "techniqueID": "T1087", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1020", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1015", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -286765,8 +285511,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -286867,8 +285614,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -286969,8 +285717,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -287071,8 +285820,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -287173,8 +285923,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -287275,8 +286026,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -287377,8 +286129,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -287479,8 +286232,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -287581,8 +286335,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -287683,8 +286438,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -287785,8 +286541,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -287887,8 +286644,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -287989,8 +286747,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -288091,8 +286850,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -288193,8 +286953,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -288295,8 +287056,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -288397,8 +287159,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -288499,8 +287262,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -288601,8 +287365,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -288703,8 +287468,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -288805,8 +287571,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -288907,8 +287674,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -289009,8 +287777,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -289111,8 +287880,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -289213,8 +287983,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -289315,8 +288086,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -289417,8 +288189,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -289519,8 +288292,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -289621,8 +288395,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -289723,8 +288498,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -289825,8 +288601,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -289927,8 +288704,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -290029,8 +288807,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -290131,8 +288910,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -290233,8 +289013,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -290335,8 +289116,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -290437,8 +289219,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -290539,8 +289322,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -290641,8 +289425,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -290743,110 +289528,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" - }, - { - "techniqueID": "T1195.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1573.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1075", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" - }, - { - "techniqueID": "T1223", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1158", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" - }, - { - "techniqueID": "T1564.001", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" - }, - { - "techniqueID": "T1102.001", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.003", "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" - }, - { - "techniqueID": "T1040", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1120", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1546.008", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" - }, - { - "techniqueID": "T1087", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1020", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1015", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -290947,8 +289631,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -291049,8 +289734,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -291151,8 +289837,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -291253,8 +289940,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -291355,8 +290043,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -291457,8 +290146,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -291559,8 +290249,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -291661,8 +290352,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -291763,8 +290455,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -291865,8 +290558,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -291967,8 +290661,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -292069,8 +290764,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -292171,8 +290867,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -292273,8 +290970,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -292375,8 +291073,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -292477,8 +291176,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -292579,8 +291279,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -292681,8 +291382,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -292783,8 +291485,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -292885,8 +291588,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -292987,8 +291691,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -293089,8 +291794,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -293191,8 +291897,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -293293,8 +292000,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -293395,8 +292103,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -293497,8 +292206,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -293599,8 +292309,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -293701,8 +292412,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -293803,8 +292515,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -293905,8 +292618,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -294007,8 +292721,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -294109,8 +292824,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -294211,8 +292927,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -294313,8 +293030,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -294415,8 +293133,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -294517,8 +293236,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -294619,8 +293339,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -294721,8 +293442,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -294823,8 +293545,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -294925,110 +293648,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" - }, - { - "techniqueID": "T1195.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1573.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1075", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" - }, - { - "techniqueID": "T1223", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1158", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" - }, - { - "techniqueID": "T1564.001", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" - }, - { - "techniqueID": "T1102.001", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.003", "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" - }, - { - "techniqueID": "T1040", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1120", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1546.008", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" - }, - { - "techniqueID": "T1087", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1020", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1015", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -295129,8 +293751,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -295231,8 +293854,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -295333,8 +293957,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -295435,8 +294060,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -295537,8 +294163,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -295639,8 +294266,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -295741,8 +294369,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -295843,8 +294472,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -295945,8 +294575,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -296047,8 +294678,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -296149,8 +294781,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -296251,8 +294884,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -296353,8 +294987,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -296455,8 +295090,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -296557,8 +295193,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -296659,8 +295296,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -296761,8 +295399,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -296863,8 +295502,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -296965,8 +295605,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -297067,8 +295708,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -297169,8 +295811,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -297271,8 +295914,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -297373,8 +296017,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -297475,8 +296120,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -297577,8 +296223,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -297679,8 +296326,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -297781,8 +296429,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -297883,8 +296532,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -297985,8 +296635,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -298087,8 +296738,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -298189,8 +296841,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -298291,8 +296944,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -298393,8 +297047,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -298495,8 +297150,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -298597,8 +297253,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -298699,8 +297356,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -298801,8 +297459,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -298903,8 +297562,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -299005,8 +297665,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -299107,110 +297768,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" - }, - { - "techniqueID": "T1195.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1573.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1075", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" - }, - { - "techniqueID": "T1223", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1158", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" - }, - { - "techniqueID": "T1564.001", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" - }, - { - "techniqueID": "T1102.001", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.003", "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" - }, - { - "techniqueID": "T1040", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1120", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1546.008", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" - }, - { - "techniqueID": "T1087", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1020", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1015", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -299311,8 +297871,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -299413,8 +297974,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -299515,8 +298077,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -299617,8 +298180,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -299719,8 +298283,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -299821,8 +298386,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -299923,8 +298489,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -300025,8 +298592,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -300127,8 +298695,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -300229,8 +298798,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -300331,8 +298901,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -300433,8 +299004,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -300535,8 +299107,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -300637,8 +299210,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -300739,8 +299313,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -300841,8 +299416,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -300943,8 +299519,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -301045,8 +299622,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -301147,8 +299725,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -301249,8 +299828,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -301351,8 +299931,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -301453,8 +300034,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -301555,8 +300137,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -301657,8 +300240,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -301759,8 +300343,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -301861,8 +300446,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -301963,8 +300549,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -302065,8 +300652,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -302167,8 +300755,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -302269,8 +300858,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -302371,8 +300961,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -302473,8 +301064,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -302575,8 +301167,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -302677,8 +301270,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -302779,8 +301373,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -302881,8 +301476,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -302983,8 +301579,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -303085,8 +301682,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -303187,8 +301785,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -303289,110 +301888,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" - }, - { - "techniqueID": "T1195.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1573.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1075", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" - }, - { - "techniqueID": "T1223", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1158", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" - }, - { - "techniqueID": "T1564.001", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" - }, - { - "techniqueID": "T1102.001", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.003", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" - }, - { - "techniqueID": "T1040", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1120", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1546.008", "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" - }, - { - "techniqueID": "T1087", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1020", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1015", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -303493,110 +301991,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" - }, - { - "techniqueID": "T1195.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1573.002", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1075", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" - }, - { - "techniqueID": "T1223", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1158", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" - }, - { - "techniqueID": "T1564.001", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" - }, - { - "techniqueID": "T1102.001", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1078.003", "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" - }, - { - "techniqueID": "T1040", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1120", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1550", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1546.008", - "score": 4, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" - }, - { - "techniqueID": "T1087", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1020", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1015", - "score": 5, - "showSubtechniques": false - }, - { - "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -303697,8 +302094,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -303799,8 +302197,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -303901,8 +302300,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -304003,8 +302403,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -304105,8 +302506,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -304207,8 +302609,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -304309,8 +302712,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -304411,8 +302815,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -304513,8 +302918,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -304615,8 +303021,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -304717,8 +303124,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -304819,8 +303227,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -304921,8 +303330,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -305023,8 +303433,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -305125,8 +303536,9 @@ }, { "techniqueID": "T1566", - "score": 5, - "showSubtechniques": false + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" }, { "techniqueID": "T1218.001", @@ -305189,850 +303601,1240 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" }, { - "techniqueID": "T1561.002", - "score": 4, + "techniqueID": "T1040", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1014", - "score": 4, + "techniqueID": "T1120", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1560.003", - "score": 4, + "techniqueID": "T1550", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1025", + "techniqueID": "T1546.008", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1087", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1020", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1093", - "score": 4, + "techniqueID": "T1015", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1110.002", + "techniqueID": "T1566", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + { + "techniqueID": "T1218.001", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, + { + "techniqueID": "T1195.002", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1487", - "score": 4, + "techniqueID": "T1573.002", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1574.001", - "score": 4, + "techniqueID": "T1075", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1195", - "score": 4, + "techniqueID": "T1078.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1223", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1038", - "score": 4, + "techniqueID": "T1158", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1110.003", + "techniqueID": "T1550.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" + }, + { + "techniqueID": "T1564.001", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + }, + { + "techniqueID": "T1102.001", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1003.005", + "techniqueID": "T1078.003", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + }, + { + "techniqueID": "T1040", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1036.002", - "score": 4, + "techniqueID": "T1120", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1568", - "score": 4, + "techniqueID": "T1550", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1071.002", - "score": 3, + "techniqueID": "T1546.008", + "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" }, { - "techniqueID": "T1001", - "score": 4, + "techniqueID": "T1087", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1020", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1039", + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1566", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + { + "techniqueID": "T1218.001", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { - "techniqueID": "T1055.012", - "score": 4, + "techniqueID": "T1195.002", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": false }, { - "techniqueID": "T1570", - "score": 4, + "techniqueID": "T1075", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1095", + "techniqueID": "T1078.002", "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, { - "techniqueID": "T1496", - "score": 4, + "techniqueID": "T1223", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1213", - "score": 4, + "techniqueID": "T1158", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1518", + "techniqueID": "T1550.002", "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" }, { - "techniqueID": "T1003.003", - "score": -2, + "techniqueID": "T1564.001", + "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" }, { - "techniqueID": "T1124", - "score": 4, + "techniqueID": "T1102.001", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1094", + "techniqueID": "T1078.003", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + }, + { + "techniqueID": "T1040", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1561.002", - "score": 4, + "techniqueID": "T1120", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1014", - "score": 4, + "techniqueID": "T1550", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1560.003", + "techniqueID": "T1546.008", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1087", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1020", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1025", - "score": 4, + "techniqueID": "T1015", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1093", + "techniqueID": "T1566", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + { + "techniqueID": "T1218.001", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, + { + "techniqueID": "T1195.002", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1110.002", - "score": 4, + "techniqueID": "T1573.002", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1487", - "score": 4, + "techniqueID": "T1075", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1574.001", - "score": 4, + "techniqueID": "T1078.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1223", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1195", - "score": 4, + "techniqueID": "T1158", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1038", + "techniqueID": "T1550.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" + }, + { + "techniqueID": "T1564.001", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + }, + { + "techniqueID": "T1102.001", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1110.003", + "techniqueID": "T1078.003", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + }, + { + "techniqueID": "T1040", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1003.005", - "score": 4, + "techniqueID": "T1120", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1036.002", - "score": 4, + "techniqueID": "T1550", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1568", + "techniqueID": "T1546.008", "score": 4, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" }, { - "techniqueID": "T1071.002", - "score": 3, + "techniqueID": "T1087", + "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" }, { - "techniqueID": "T1001", - "score": 4, + "techniqueID": "T1020", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1039", + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1566", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + { + "techniqueID": "T1218.001", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { - "techniqueID": "T1055.012", - "score": 4, + "techniqueID": "T1195.002", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": false }, { - "techniqueID": "T1570", - "score": 4, + "techniqueID": "T1075", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1095", + "techniqueID": "T1078.002", "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, { - "techniqueID": "T1496", - "score": 4, + "techniqueID": "T1223", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1213", - "score": 4, + "techniqueID": "T1158", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1518", + "techniqueID": "T1550.002", "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" }, { - "techniqueID": "T1003.003", - "score": -2, + "techniqueID": "T1564.001", + "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" }, { - "techniqueID": "T1124", - "score": 4, + "techniqueID": "T1102.001", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1094", + "techniqueID": "T1078.003", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + }, + { + "techniqueID": "T1040", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1561.002", - "score": 4, + "techniqueID": "T1120", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1014", - "score": 4, + "techniqueID": "T1550", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1560.003", + "techniqueID": "T1546.008", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1087", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1020", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1025", - "score": 4, + "techniqueID": "T1015", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1093", + "techniqueID": "T1566", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + { + "techniqueID": "T1218.001", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, + { + "techniqueID": "T1195.002", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1110.002", - "score": 4, + "techniqueID": "T1573.002", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1487", - "score": 4, + "techniqueID": "T1075", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1574.001", - "score": 4, + "techniqueID": "T1078.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1223", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1195", - "score": 4, + "techniqueID": "T1158", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1038", + "techniqueID": "T1550.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" + }, + { + "techniqueID": "T1564.001", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + }, + { + "techniqueID": "T1102.001", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1110.003", + "techniqueID": "T1078.003", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + }, + { + "techniqueID": "T1040", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1003.005", - "score": 4, + "techniqueID": "T1120", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1036.002", - "score": 4, + "techniqueID": "T1550", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1568", + "techniqueID": "T1546.008", "score": 4, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" }, { - "techniqueID": "T1071.002", - "score": 3, + "techniqueID": "T1087", + "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" }, { - "techniqueID": "T1001", - "score": 4, + "techniqueID": "T1020", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1039", + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1566", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + { + "techniqueID": "T1218.001", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { - "techniqueID": "T1055.012", - "score": 4, + "techniqueID": "T1195.002", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": false }, { - "techniqueID": "T1570", - "score": 4, + "techniqueID": "T1075", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1095", + "techniqueID": "T1078.002", "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, { - "techniqueID": "T1496", - "score": 4, + "techniqueID": "T1223", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1213", - "score": 4, + "techniqueID": "T1158", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1518", + "techniqueID": "T1550.002", "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" }, { - "techniqueID": "T1003.003", - "score": -2, + "techniqueID": "T1564.001", + "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" }, { - "techniqueID": "T1124", - "score": 4, + "techniqueID": "T1102.001", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1094", + "techniqueID": "T1078.003", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + }, + { + "techniqueID": "T1040", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1561.002", - "score": 4, + "techniqueID": "T1120", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1014", - "score": 4, + "techniqueID": "T1550", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1560.003", + "techniqueID": "T1546.008", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1087", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1020", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1025", - "score": 4, + "techniqueID": "T1015", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1093", + "techniqueID": "T1566", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + { + "techniqueID": "T1218.001", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, + { + "techniqueID": "T1195.002", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1110.002", - "score": 4, + "techniqueID": "T1573.002", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1487", - "score": 4, + "techniqueID": "T1075", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1574.001", - "score": 4, + "techniqueID": "T1078.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1223", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1195", - "score": 4, + "techniqueID": "T1158", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1038", + "techniqueID": "T1550.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" + }, + { + "techniqueID": "T1564.001", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + }, + { + "techniqueID": "T1102.001", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1110.003", + "techniqueID": "T1078.003", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + }, + { + "techniqueID": "T1040", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1003.005", - "score": 4, + "techniqueID": "T1120", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1036.002", - "score": 4, + "techniqueID": "T1550", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1568", + "techniqueID": "T1546.008", "score": 4, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" }, { - "techniqueID": "T1071.002", - "score": 3, + "techniqueID": "T1087", + "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" }, { - "techniqueID": "T1001", - "score": 4, + "techniqueID": "T1020", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1039", + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1566", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + { + "techniqueID": "T1218.001", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { - "techniqueID": "T1055.012", - "score": 4, + "techniqueID": "T1195.002", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": false }, { - "techniqueID": "T1570", - "score": 4, + "techniqueID": "T1075", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1095", + "techniqueID": "T1078.002", "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, { - "techniqueID": "T1496", - "score": 4, + "techniqueID": "T1223", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1213", - "score": 4, + "techniqueID": "T1158", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1518", + "techniqueID": "T1550.002", "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" }, { - "techniqueID": "T1003.003", - "score": -2, + "techniqueID": "T1564.001", + "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" }, { - "techniqueID": "T1124", - "score": 4, + "techniqueID": "T1102.001", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1094", + "techniqueID": "T1078.003", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + }, + { + "techniqueID": "T1040", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1561.002", - "score": 4, + "techniqueID": "T1120", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1014", - "score": 4, + "techniqueID": "T1550", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1560.003", + "techniqueID": "T1546.008", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1087", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1020", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1025", - "score": 4, + "techniqueID": "T1015", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1093", + "techniqueID": "T1566", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + { + "techniqueID": "T1218.001", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, + { + "techniqueID": "T1195.002", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1110.002", - "score": 4, + "techniqueID": "T1573.002", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1487", - "score": 4, + "techniqueID": "T1075", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1574.001", - "score": 4, + "techniqueID": "T1078.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1223", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1195", - "score": 4, + "techniqueID": "T1158", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1038", + "techniqueID": "T1550.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" + }, + { + "techniqueID": "T1564.001", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + }, + { + "techniqueID": "T1102.001", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1110.003", + "techniqueID": "T1078.003", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + }, + { + "techniqueID": "T1040", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1003.005", - "score": 4, + "techniqueID": "T1120", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1036.002", - "score": 4, + "techniqueID": "T1550", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1568", + "techniqueID": "T1546.008", "score": 4, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" }, { - "techniqueID": "T1071.002", - "score": 3, + "techniqueID": "T1087", + "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" }, { - "techniqueID": "T1001", - "score": 4, + "techniqueID": "T1020", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1039", + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1566", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + { + "techniqueID": "T1218.001", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { - "techniqueID": "T1055.012", - "score": 4, + "techniqueID": "T1195.002", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": false }, { - "techniqueID": "T1570", - "score": 4, + "techniqueID": "T1075", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1095", + "techniqueID": "T1078.002", "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, { - "techniqueID": "T1496", - "score": 4, + "techniqueID": "T1223", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1213", - "score": 4, + "techniqueID": "T1158", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1518", + "techniqueID": "T1550.002", "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" }, { - "techniqueID": "T1003.003", - "score": -2, + "techniqueID": "T1564.001", + "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" }, { - "techniqueID": "T1124", - "score": 4, + "techniqueID": "T1102.001", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1094", + "techniqueID": "T1078.003", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + }, + { + "techniqueID": "T1040", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1561.002", - "score": 4, + "techniqueID": "T1120", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1014", - "score": 4, + "techniqueID": "T1550", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1560.003", + "techniqueID": "T1546.008", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" + }, + { + "techniqueID": "T1087", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1020", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1025", - "score": 4, + "techniqueID": "T1015", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1093", + "techniqueID": "T1566", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + { + "techniqueID": "T1218.001", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" + }, + { + "techniqueID": "T1195.002", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1110.002", - "score": 4, + "techniqueID": "T1573.002", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1487", - "score": 4, + "techniqueID": "T1075", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1574.001", - "score": 4, + "techniqueID": "T1078.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" + }, + { + "techniqueID": "T1223", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1195", - "score": 4, + "techniqueID": "T1158", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1038", + "techniqueID": "T1550.002", + "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" + }, + { + "techniqueID": "T1564.001", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + }, + { + "techniqueID": "T1102.001", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1110.003", + "techniqueID": "T1078.003", "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" + }, + { + "techniqueID": "T1040", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1003.005", - "score": 4, + "techniqueID": "T1120", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1036.002", - "score": 4, + "techniqueID": "T1550", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1568", + "techniqueID": "T1546.008", "score": 4, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml" }, { - "techniqueID": "T1071.002", - "score": 3, + "techniqueID": "T1087", + "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml" }, { - "techniqueID": "T1001", - "score": 4, + "techniqueID": "T1020", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1039", + "techniqueID": "T1015", + "score": 5, + "showSubtechniques": false + }, + { + "techniqueID": "T1566", + "score": 4, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml" + }, + { + "techniqueID": "T1218.001", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml" }, { - "techniqueID": "T1055.012", - "score": 4, + "techniqueID": "T1195.002", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "techniqueID": "T1573.002", + "score": 5, + "showSubtechniques": false }, { - "techniqueID": "T1570", - "score": 4, + "techniqueID": "T1075", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1095", + "techniqueID": "T1078.002", "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml" }, { - "techniqueID": "T1496", - "score": 4, + "techniqueID": "T1223", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1213", - "score": 4, + "techniqueID": "T1158", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1518", + "techniqueID": "T1550.002", "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml" }, { - "techniqueID": "T1003.003", - "score": -2, + "techniqueID": "T1564.001", + "score": 4, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" }, { - "techniqueID": "T1124", - "score": 4, + "techniqueID": "T1102.001", + "score": 5, "showSubtechniques": false }, { - "techniqueID": "T1094", + "techniqueID": "T1078.003", "score": 4, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml" }, { "techniqueID": "T1561.002", @@ -306106,9 +304908,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -306139,9 +304940,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -306247,9 +305047,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -306280,9 +305079,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -306388,9 +305186,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -306421,9 +305218,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -306529,9 +305325,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -306562,9 +305357,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -306670,9 +305464,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -306703,9 +305496,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -306811,9 +305603,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -306844,9 +305635,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -306952,9 +305742,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -306985,9 +305774,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -307093,9 +305881,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -307126,9 +305913,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -307234,9 +306020,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -307267,9 +306052,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -307375,151 +306159,9 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, - { - "techniqueID": "T1001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1039", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1055.012", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" - }, - { - "techniqueID": "T1570", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, - { - "techniqueID": "T1496", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1213", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1518", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1003.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" - }, - { - "techniqueID": "T1124", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1094", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1561.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1014", "score": 4, "showSubtechniques": false }, - { - "techniqueID": "T1560.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1025", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1093", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1487", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1574.001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1195", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1038", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.005", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1568", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, { "techniqueID": "T1001", "score": 4, @@ -307549,9 +306191,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -307657,9 +306298,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -307690,9 +306330,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -307798,9 +306437,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -307831,9 +306469,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -307939,9 +306576,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -307972,9 +306608,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -308080,9 +306715,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -308113,9 +306747,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -308221,9 +306854,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -308254,9 +306886,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -308362,9 +306993,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -308395,9 +307025,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -308503,9 +307132,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -308536,9 +307164,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -308644,9 +307271,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -308677,9 +307303,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -308785,9 +307410,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -308818,9 +307442,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -308926,9 +307549,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -308959,9 +307581,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -309067,9 +307688,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -309100,9 +307720,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -309208,9 +307827,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -309241,9 +307859,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -309349,9 +307966,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -309382,9 +307998,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -309490,9 +308105,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -309523,9 +308137,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -309631,9 +308244,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -309664,151 +308276,9 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, - { - "techniqueID": "T1496", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1213", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1518", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1003.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" - }, - { - "techniqueID": "T1124", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1094", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1561.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1014", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1025", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1093", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1487", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1574.001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1195", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1038", "score": 4, "showSubtechniques": false }, - { - "techniqueID": "T1110.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.005", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1568", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, - { - "techniqueID": "T1001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1039", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1055.012", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" - }, - { - "techniqueID": "T1570", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, { "techniqueID": "T1496", "score": 4, @@ -309913,9 +308383,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -309946,9 +308415,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -310054,9 +308522,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -310087,9 +308554,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -310195,9 +308661,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -310228,9 +308693,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -310336,9 +308800,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -310369,9 +308832,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -310477,9 +308939,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -310510,9 +308971,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -310618,9 +309078,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -310651,9 +309110,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -310759,9 +309217,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -310792,9 +309249,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -310900,9 +309356,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -310933,9 +309388,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -311041,9 +309495,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -311074,9 +309527,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -311182,9 +309634,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -311215,9 +309666,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -311323,9 +309773,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -311356,9 +309805,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -311464,9 +309912,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -311497,9 +309944,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -311605,9 +310051,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -311638,9 +310083,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -311746,9 +310190,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -311779,9 +310222,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -311887,9 +310329,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -311920,9 +310361,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -312028,151 +310468,9 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, - { - "techniqueID": "T1001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1039", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1055.012", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" - }, - { - "techniqueID": "T1570", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, - { - "techniqueID": "T1496", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1213", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1518", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1003.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" - }, - { - "techniqueID": "T1124", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1094", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1561.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1014", "score": 4, "showSubtechniques": false }, - { - "techniqueID": "T1560.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1025", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1093", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1487", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1574.001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1195", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1038", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.005", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1568", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, { "techniqueID": "T1001", "score": 4, @@ -312202,9 +310500,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -312310,9 +310607,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -312343,9 +310639,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -312451,9 +310746,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -312484,9 +310778,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -312592,9 +310885,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -312625,9 +310917,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -312733,9 +311024,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -312766,9 +311056,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -312874,9 +311163,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -312907,9 +311195,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -313015,9 +311302,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -313048,9 +311334,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -313156,9 +311441,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -313189,9 +311473,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -313297,9 +311580,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -313330,9 +311612,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -313438,9 +311719,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -313471,9 +311751,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -313579,9 +311858,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -313612,9 +311890,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -313720,9 +311997,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -313753,9 +312029,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -313861,9 +312136,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -313894,9 +312168,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -314002,9 +312275,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -314035,9 +312307,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -314143,9 +312414,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -314176,9 +312446,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -314284,9 +312553,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -314317,151 +312585,9 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, - { - "techniqueID": "T1496", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1213", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1518", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1003.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" - }, - { - "techniqueID": "T1124", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1094", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1561.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1014", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1025", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1093", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1487", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1574.001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1195", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1038", "score": 4, "showSubtechniques": false }, - { - "techniqueID": "T1110.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.005", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1568", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, - { - "techniqueID": "T1001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1039", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1055.012", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" - }, - { - "techniqueID": "T1570", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, { "techniqueID": "T1496", "score": 4, @@ -314566,9 +312692,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -314599,9 +312724,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -314707,9 +312831,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -314740,9 +312863,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -314848,9 +312970,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -314881,9 +313002,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -314989,9 +313109,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -315022,9 +313141,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -315130,9 +313248,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -315163,9 +313280,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -315271,9 +313387,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -315304,9 +313419,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -315412,9 +313526,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -315445,9 +313558,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -315553,9 +313665,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -315586,9 +313697,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -315694,9 +313804,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -315727,9 +313836,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -315835,9 +313943,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -315868,9 +313975,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -315976,9 +314082,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -316009,9 +314114,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -316117,9 +314221,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -316150,9 +314253,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -316258,9 +314360,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -316291,9 +314392,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -316399,9 +314499,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -316432,9 +314531,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -316540,9 +314638,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -316573,9 +314670,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -316681,151 +314777,9 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, - { - "techniqueID": "T1001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1039", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1055.012", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" - }, - { - "techniqueID": "T1570", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, - { - "techniqueID": "T1496", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1213", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1518", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1003.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" - }, - { - "techniqueID": "T1124", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1094", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1561.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1014", "score": 4, "showSubtechniques": false }, - { - "techniqueID": "T1560.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1025", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1093", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1487", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1574.001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1195", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1038", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.005", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1568", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, { "techniqueID": "T1001", "score": 4, @@ -316855,9 +314809,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -316963,9 +314916,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -316996,9 +314948,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -317104,9 +315055,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -317137,9 +315087,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -317245,9 +315194,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -317278,9 +315226,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -317386,9 +315333,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -317419,9 +315365,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -317527,9 +315472,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -317560,9 +315504,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -317668,9 +315611,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -317701,9 +315643,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -317809,9 +315750,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -317842,9 +315782,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -317950,9 +315889,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -317983,9 +315921,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -318091,9 +316028,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -318124,9 +316060,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -318232,9 +316167,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -318265,9 +316199,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -318373,9 +316306,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -318406,9 +316338,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -318514,9 +316445,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -318547,9 +316477,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -318655,9 +316584,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -318688,9 +316616,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -318796,9 +316723,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -318829,9 +316755,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -318937,9 +316862,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -318970,151 +316894,9 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, - { - "techniqueID": "T1496", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1213", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1518", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1003.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" - }, - { - "techniqueID": "T1124", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1094", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1561.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1014", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1025", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1093", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1487", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1574.001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1195", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1038", "score": 4, "showSubtechniques": false }, - { - "techniqueID": "T1110.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.005", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1568", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, - { - "techniqueID": "T1001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1039", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1055.012", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" - }, - { - "techniqueID": "T1570", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, { "techniqueID": "T1496", "score": 4, @@ -319219,9 +317001,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -319252,9 +317033,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -319360,9 +317140,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -319393,9 +317172,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -319501,9 +317279,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -319534,9 +317311,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -319642,9 +317418,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -319675,9 +317450,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -319783,9 +317557,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -319816,9 +317589,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -319924,9 +317696,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -319957,9 +317728,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -320065,9 +317835,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -320098,9 +317867,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -320206,9 +317974,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -320239,9 +318006,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -320347,9 +318113,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -320380,9 +318145,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -320488,9 +318252,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -320521,9 +318284,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -320629,9 +318391,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -320662,9 +318423,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -320770,9 +318530,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -320803,9 +318562,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -320911,9 +318669,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -320944,9 +318701,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -321052,9 +318808,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -321085,9 +318840,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -321193,9 +318947,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -321226,9 +318979,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -321334,151 +319086,9 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, - { - "techniqueID": "T1001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1039", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1055.012", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" - }, - { - "techniqueID": "T1570", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, - { - "techniqueID": "T1496", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1213", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1518", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1003.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" - }, - { - "techniqueID": "T1124", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1094", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1561.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1014", "score": 4, "showSubtechniques": false }, - { - "techniqueID": "T1560.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1025", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1093", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1487", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1574.001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1195", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1038", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.005", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1568", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, { "techniqueID": "T1001", "score": 4, @@ -321508,9 +319118,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -321616,9 +319225,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -321649,9 +319257,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -321757,9 +319364,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -321790,9 +319396,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -321898,9 +319503,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -321931,9 +319535,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -322039,9 +319642,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -322072,9 +319674,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -322180,9 +319781,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -322213,9 +319813,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -322321,9 +319920,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -322354,9 +319952,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -322462,9 +320059,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -322495,9 +320091,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -322603,9 +320198,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -322636,9 +320230,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -322744,9 +320337,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -322777,9 +320369,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -322885,9 +320476,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -322918,9 +320508,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -323026,9 +320615,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -323059,9 +320647,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -323167,9 +320754,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -323200,9 +320786,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -323308,9 +320893,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -323341,9 +320925,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -323449,9 +321032,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -323482,9 +321064,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -323590,9 +321171,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -323623,151 +321203,9 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, - { - "techniqueID": "T1496", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1213", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1518", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1003.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" - }, - { - "techniqueID": "T1124", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1094", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1561.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1014", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1025", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1093", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1487", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1574.001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1195", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1038", "score": 4, "showSubtechniques": false }, - { - "techniqueID": "T1110.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.005", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1568", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, - { - "techniqueID": "T1001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1039", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1055.012", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" - }, - { - "techniqueID": "T1570", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, { "techniqueID": "T1496", "score": 4, @@ -323872,9 +321310,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -323905,9 +321342,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -324013,9 +321449,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -324046,9 +321481,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -324154,9 +321588,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -324187,9 +321620,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -324295,9 +321727,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -324328,9 +321759,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -324436,9 +321866,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -324469,9 +321898,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -324577,9 +322005,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -324610,9 +322037,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -324718,9 +322144,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -324751,9 +322176,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -324859,9 +322283,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -324892,9 +322315,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -325000,9 +322422,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -325033,9 +322454,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -325141,9 +322561,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -325174,9 +322593,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -325282,9 +322700,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -325315,9 +322732,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -325423,9 +322839,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -325456,9 +322871,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -325564,9 +322978,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -325597,9 +323010,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -325705,9 +323117,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -325738,9 +323149,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -325846,9 +323256,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -325879,9 +323288,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -325987,151 +323395,9 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, - { - "techniqueID": "T1001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1039", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1055.012", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" - }, - { - "techniqueID": "T1570", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, - { - "techniqueID": "T1496", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1213", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1518", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1003.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" - }, - { - "techniqueID": "T1124", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1094", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1561.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1014", "score": 4, "showSubtechniques": false }, - { - "techniqueID": "T1560.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1025", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1093", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1487", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1574.001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1195", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1038", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.005", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1568", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, { "techniqueID": "T1001", "score": 4, @@ -326161,9 +323427,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -326269,9 +323534,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -326302,9 +323566,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -326410,9 +323673,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -326443,9 +323705,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -326551,9 +323812,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -326584,9 +323844,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -326692,9 +323951,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -326725,9 +323983,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -326833,9 +324090,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -326866,9 +324122,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -326974,9 +324229,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -327007,9 +324261,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -327115,9 +324368,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -327148,9 +324400,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -327256,9 +324507,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -327289,9 +324539,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -327397,9 +324646,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -327430,9 +324678,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -327538,9 +324785,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -327571,9 +324817,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -327679,9 +324924,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -327712,9 +324956,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -327820,9 +325063,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -327853,9 +325095,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -327961,9 +325202,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -327994,9 +325234,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -328102,9 +325341,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -328135,9 +325373,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -328243,9 +325480,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -328276,151 +325512,9 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, - { - "techniqueID": "T1496", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1213", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1518", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1003.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" - }, - { - "techniqueID": "T1124", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1094", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1561.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1014", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1025", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1093", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1487", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1574.001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1195", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1038", "score": 4, "showSubtechniques": false }, - { - "techniqueID": "T1110.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.005", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1568", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, - { - "techniqueID": "T1001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1039", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1055.012", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" - }, - { - "techniqueID": "T1570", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, { "techniqueID": "T1496", "score": 4, @@ -328525,9 +325619,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -328558,9 +325651,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -328666,9 +325758,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -328699,9 +325790,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -328807,9 +325897,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -328840,9 +325929,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -328948,9 +326036,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -328981,9 +326068,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -329089,9 +326175,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -329122,9 +326207,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -329230,9 +326314,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -329263,9 +326346,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -329371,9 +326453,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -329404,9 +326485,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -329512,9 +326592,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -329545,9 +326624,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -329653,9 +326731,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -329686,9 +326763,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -329794,9 +326870,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -329827,9 +326902,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -329935,9 +327009,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -329968,9 +327041,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -330076,9 +327148,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -330109,9 +327180,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -330217,9 +327287,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -330250,9 +327319,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -330358,9 +327426,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -330391,9 +327458,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -330499,9 +327565,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -330532,9 +327597,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -330640,151 +327704,9 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, - { - "techniqueID": "T1001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1039", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1055.012", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" - }, - { - "techniqueID": "T1570", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, - { - "techniqueID": "T1496", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1213", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1518", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1003.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" - }, - { - "techniqueID": "T1124", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1094", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1561.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1014", "score": 4, "showSubtechniques": false }, - { - "techniqueID": "T1560.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1025", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1093", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1487", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1574.001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1195", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1038", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.005", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1568", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, { "techniqueID": "T1001", "score": 4, @@ -330814,9 +327736,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -330922,9 +327843,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -330955,9 +327875,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -331063,9 +327982,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -331096,9 +328014,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -331204,9 +328121,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -331237,9 +328153,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -331345,9 +328260,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -331378,9 +328292,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -331486,9 +328399,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -331519,9 +328431,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -331627,9 +328538,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -331660,9 +328570,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -331768,9 +328677,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -331801,9 +328709,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -331909,9 +328816,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -331942,9 +328848,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -332050,9 +328955,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -332083,9 +328987,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -332191,9 +329094,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -332224,9 +329126,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -332332,9 +329233,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -332365,9 +329265,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -332473,9 +329372,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -332506,9 +329404,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -332614,9 +329511,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -332647,9 +329543,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -332755,9 +329650,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -332788,9 +329682,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -332896,9 +329789,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -332929,151 +329821,9 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, - { - "techniqueID": "T1496", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1213", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1518", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1003.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" - }, - { - "techniqueID": "T1124", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1094", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1561.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1014", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1025", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1093", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1487", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1574.001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1195", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1038", "score": 4, "showSubtechniques": false }, - { - "techniqueID": "T1110.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.005", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1568", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, - { - "techniqueID": "T1001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1039", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1055.012", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" - }, - { - "techniqueID": "T1570", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, { "techniqueID": "T1496", "score": 4, @@ -333178,9 +329928,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -333211,9 +329960,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -333319,9 +330067,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -333352,9 +330099,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -333460,9 +330206,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -333493,9 +330238,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -333601,9 +330345,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -333634,9 +330377,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -333742,9 +330484,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -333775,9 +330516,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -333883,9 +330623,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -333916,9 +330655,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -334024,9 +330762,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -334057,9 +330794,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -334165,9 +330901,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -334198,9 +330933,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -334306,9 +331040,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -334339,9 +331072,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -334447,9 +331179,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -334480,9 +331211,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -334588,9 +331318,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -334621,9 +331350,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -334729,9 +331457,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -334762,9 +331489,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -334870,9 +331596,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -334903,9 +331628,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -335011,9 +331735,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -335044,9 +331767,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -335152,9 +331874,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -335185,9 +331906,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -335293,151 +332013,9 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, - { - "techniqueID": "T1001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1039", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1055.012", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" - }, - { - "techniqueID": "T1570", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, - { - "techniqueID": "T1496", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1213", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1518", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1003.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" - }, - { - "techniqueID": "T1124", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1094", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1561.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1014", "score": 4, "showSubtechniques": false }, - { - "techniqueID": "T1560.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1025", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1093", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1487", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1574.001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1195", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1038", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.005", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1568", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, { "techniqueID": "T1001", "score": 4, @@ -335467,9 +332045,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -335575,9 +332152,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -335608,9 +332184,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -335716,9 +332291,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -335749,9 +332323,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -335857,9 +332430,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -335890,9 +332462,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -335998,9 +332569,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -336031,9 +332601,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -336139,9 +332708,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -336172,9 +332740,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -336280,9 +332847,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -336313,9 +332879,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -336421,9 +332986,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -336454,9 +333018,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -336562,9 +333125,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -336595,9 +333157,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -336703,9 +333264,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -336736,9 +333296,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -336844,9 +333403,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -336877,9 +333435,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -336985,9 +333542,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -337018,9 +333574,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -337126,9 +333681,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -337159,9 +333713,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -337267,9 +333820,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -337300,9 +333852,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -337408,9 +333959,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -337441,9 +333991,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -337549,9 +334098,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -337582,151 +334130,9 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, - { - "techniqueID": "T1496", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1213", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1518", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1003.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" - }, - { - "techniqueID": "T1124", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1094", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1561.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1014", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1025", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1093", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1487", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1574.001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1195", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1038", "score": 4, "showSubtechniques": false }, - { - "techniqueID": "T1110.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.005", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1568", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, - { - "techniqueID": "T1001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1039", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1055.012", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" - }, - { - "techniqueID": "T1570", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, { "techniqueID": "T1496", "score": 4, @@ -337831,9 +334237,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -337864,9 +334269,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -337972,9 +334376,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -338005,9 +334408,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -338113,9 +334515,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -338146,9 +334547,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -338254,9 +334654,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -338287,9 +334686,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -338395,9 +334793,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -338428,9 +334825,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -338536,9 +334932,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -338569,9 +334964,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -338677,9 +335071,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -338710,9 +335103,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -338818,9 +335210,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -338851,9 +335242,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -338959,9 +335349,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -338992,9 +335381,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -339100,9 +335488,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -339133,9 +335520,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -339241,9 +335627,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -339274,9 +335659,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -339382,9 +335766,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -339415,9 +335798,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -339523,9 +335905,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -339556,9 +335937,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -339664,9 +336044,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -339697,9 +336076,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -339805,9 +336183,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -339838,9 +336215,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -339946,151 +336322,9 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, - { - "techniqueID": "T1001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1039", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1055.012", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" - }, - { - "techniqueID": "T1570", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, - { - "techniqueID": "T1496", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1213", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1518", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1003.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" - }, - { - "techniqueID": "T1124", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1094", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1561.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1014", "score": 4, "showSubtechniques": false }, - { - "techniqueID": "T1560.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1025", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1093", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1487", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1574.001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1195", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1038", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.005", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1568", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, { "techniqueID": "T1001", "score": 4, @@ -340120,9 +336354,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -340228,9 +336461,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -340261,9 +336493,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -340369,9 +336600,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -340402,9 +336632,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -340510,9 +336739,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -340543,9 +336771,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -340651,9 +336878,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -340684,9 +336910,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -340792,9 +337017,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -340825,9 +337049,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -340933,9 +337156,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -340966,9 +337188,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -341074,9 +337295,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -341107,9 +337327,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -341215,9 +337434,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -341248,9 +337466,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -341356,9 +337573,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -341389,9 +337605,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -341497,9 +337712,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -341530,9 +337744,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -341638,9 +337851,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -341671,9 +337883,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -341779,9 +337990,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -341812,9 +338022,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -341920,9 +338129,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -341953,9 +338161,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -342061,9 +338268,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -342094,9 +338300,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -342202,9 +338407,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -342235,151 +338439,9 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, - { - "techniqueID": "T1496", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1213", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1518", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1003.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" - }, - { - "techniqueID": "T1124", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1094", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1561.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1014", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1025", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1093", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1487", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1574.001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1195", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1038", "score": 4, "showSubtechniques": false }, - { - "techniqueID": "T1110.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.005", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1568", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, - { - "techniqueID": "T1001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1039", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1055.012", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" - }, - { - "techniqueID": "T1570", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, { "techniqueID": "T1496", "score": 4, @@ -342484,9 +338546,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -342517,9 +338578,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -342625,9 +338685,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -342658,9 +338717,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -342766,9 +338824,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -342799,9 +338856,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -342907,9 +338963,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -342940,9 +338995,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -343048,9 +339102,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -343081,9 +339134,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -343189,9 +339241,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -343222,9 +339273,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -343330,9 +339380,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -343363,9 +339412,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -343471,9 +339519,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -343504,9 +339551,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -343612,9 +339658,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -343645,9 +339690,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -343753,9 +339797,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -343786,9 +339829,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -343894,9 +339936,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -343927,9 +339968,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -344035,9 +340075,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -344068,9 +340107,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -344176,9 +340214,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -344209,9 +340246,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -344317,9 +340353,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -344350,9 +340385,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -344458,9 +340492,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -344491,9 +340524,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -344599,151 +340631,9 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, - { - "techniqueID": "T1001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1039", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1055.012", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" - }, - { - "techniqueID": "T1570", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, - { - "techniqueID": "T1496", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1213", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1518", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1003.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" - }, - { - "techniqueID": "T1124", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1094", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1561.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1014", "score": 4, "showSubtechniques": false }, - { - "techniqueID": "T1560.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1025", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1093", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1487", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1574.001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1195", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1038", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.005", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1568", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, { "techniqueID": "T1001", "score": 4, @@ -344773,9 +340663,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -344881,9 +340770,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -344914,9 +340802,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -345022,9 +340909,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -345055,9 +340941,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -345163,9 +341048,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -345196,9 +341080,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -345304,9 +341187,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -345337,9 +341219,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -345445,9 +341326,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -345478,9 +341358,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -345586,9 +341465,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -345619,9 +341497,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -345727,9 +341604,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -345760,9 +341636,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -345868,9 +341743,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -345901,9 +341775,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -346009,9 +341882,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -346042,9 +341914,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -346150,9 +342021,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -346183,9 +342053,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -346291,9 +342160,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -346324,9 +342192,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -346432,9 +342299,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -346465,9 +342331,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -346573,9 +342438,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -346606,9 +342470,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -346714,9 +342577,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -346747,9 +342609,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -346855,9 +342716,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -346888,151 +342748,9 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, - { - "techniqueID": "T1496", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1213", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1518", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1003.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" - }, - { - "techniqueID": "T1124", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1094", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1561.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1014", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1025", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1093", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1487", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1574.001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1195", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1038", "score": 4, "showSubtechniques": false }, - { - "techniqueID": "T1110.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.005", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1568", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, - { - "techniqueID": "T1001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1039", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1055.012", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" - }, - { - "techniqueID": "T1570", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, { "techniqueID": "T1496", "score": 4, @@ -347137,9 +342855,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -347170,9 +342887,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -347278,9 +342994,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -347311,9 +343026,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -347419,9 +343133,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -347452,9 +343165,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -347560,9 +343272,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -347593,9 +343304,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -347701,9 +343411,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -347734,9 +343443,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -347842,9 +343550,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -347875,9 +343582,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -347983,9 +343689,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -348016,9 +343721,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -348124,9 +343828,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -348157,9 +343860,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -348265,9 +343967,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -348298,9 +343999,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -348406,9 +344106,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -348439,9 +344138,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -348547,9 +344245,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -348580,9 +344277,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -348688,9 +344384,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -348721,9 +344416,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -348829,9 +344523,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -348862,9 +344555,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -348970,9 +344662,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -349003,9 +344694,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -349111,9 +344801,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -349144,9 +344833,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -349252,151 +344940,9 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, - { - "techniqueID": "T1001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1039", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1055.012", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" - }, - { - "techniqueID": "T1570", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, - { - "techniqueID": "T1496", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1213", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1518", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1003.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" - }, - { - "techniqueID": "T1124", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1094", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1561.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1014", "score": 4, "showSubtechniques": false }, - { - "techniqueID": "T1560.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1025", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1093", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1487", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1574.001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1195", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1038", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.005", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1568", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, { "techniqueID": "T1001", "score": 4, @@ -349426,9 +344972,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -349534,9 +345079,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -349567,9 +345111,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -349675,9 +345218,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -349708,9 +345250,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -349816,9 +345357,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -349849,9 +345389,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -349957,9 +345496,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -349990,9 +345528,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -350098,9 +345635,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -350131,9 +345667,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -350239,9 +345774,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -350272,9 +345806,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -350380,9 +345913,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -350413,9 +345945,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -350521,9 +346052,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -350554,9 +346084,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -350662,9 +346191,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -350695,9 +346223,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -350803,9 +346330,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -350836,9 +346362,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -350944,9 +346469,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -350977,9 +346501,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -351085,9 +346608,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -351118,9 +346640,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -351226,9 +346747,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -351259,9 +346779,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -351367,9 +346886,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -351400,9 +346918,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -351508,9 +347025,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -351541,151 +347057,9 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, - { - "techniqueID": "T1496", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1213", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1518", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1003.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" - }, - { - "techniqueID": "T1124", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1094", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1561.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1014", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1025", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1093", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1110.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1487", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1574.001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1195", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1038", "score": 4, "showSubtechniques": false }, - { - "techniqueID": "T1110.003", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1003.005", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.002", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1568", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" - }, - { - "techniqueID": "T1001", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1039", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1055.012", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.003", - "score": -2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" - }, - { - "techniqueID": "T1570", - "score": 4, - "showSubtechniques": false - }, - { - "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" - }, { "techniqueID": "T1496", "score": 4, @@ -351790,9 +347164,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -351823,9 +347196,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -351931,9 +347303,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -351964,9 +347335,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -352072,9 +347442,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -352105,9 +347474,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -352213,9 +347581,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -352246,9 +347613,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -352354,9 +347720,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -352387,9 +347752,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -352495,9 +347859,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -352528,9 +347891,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -352636,9 +347998,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -352669,9 +348030,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -352777,9 +348137,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -352810,9 +348169,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -352918,9 +348276,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -352951,9 +348308,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -353059,9 +348415,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -353092,9 +348447,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -353200,9 +348554,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -353233,9 +348586,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -353341,9 +348693,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -353374,9 +348725,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -353482,9 +348832,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -353515,9 +348864,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -353623,9 +348971,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -353656,9 +349003,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -353764,9 +349110,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -353797,9 +349142,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -353905,9 +349249,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -353938,9 +349281,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -354046,9 +349388,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -354079,9 +349420,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -354187,9 +349527,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -354220,9 +349559,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -354328,9 +349666,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -354361,9 +349698,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -354469,9 +349805,147 @@ }, { "techniqueID": "T1071.002", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1039", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1095", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1213", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1518", "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1110.002", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1110.003", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1568", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1071.002", + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -354502,9 +349976,147 @@ }, { "techniqueID": "T1095", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1213", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1518", "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + }, + { + "techniqueID": "T1124", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1094", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1561.002", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1110.002", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1110.003", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1568", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1071.002", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1039", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + }, + { + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1095", + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -354610,9 +350222,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -354643,9 +350254,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -354751,9 +350361,8 @@ }, { "techniqueID": "T1071.002", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_outbound_smb_traffic.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1001", @@ -354784,9 +350393,8 @@ }, { "techniqueID": "T1095", - "score": 3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_large_outbound_icmp_packets.yml" + "score": 4, + "showSubtechniques": false }, { "techniqueID": "T1496", @@ -354821,2958 +350429,3339 @@ "showSubtechniques": false }, { - "techniqueID": "T1067", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1542.003", - "score": 3, + "techniqueID": "T1014", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1080", - "score": 3, + "techniqueID": "T1560.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1587.002", - "score": 3, + "techniqueID": "T1025", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1091", - "score": 3, + "techniqueID": "T1093", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.001", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1572", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1004", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1071.003", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1021.006", - "score": 3, + "techniqueID": "T1038", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1547.004", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1550.003", - "score": 3, + "techniqueID": "T1003.005", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1188", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1074", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1104", - "score": 3, + "techniqueID": "T1071.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.006", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1072", - "score": 2, + "techniqueID": "T1039", + "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1210", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1199", - "score": 2, + "techniqueID": "T1036.003", + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1069.001", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1097", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.003", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.006", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1486", - "score": -1, + "techniqueID": "T1518", + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" }, { - "techniqueID": "T1573", - "score": 3, - "showSubtechniques": false + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { - "techniqueID": "T1028", - "score": 3, + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1027.004", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1197", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1585", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1500", - "score": 3, + "techniqueID": "T1560.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1485", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1588.003", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1008", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1053.002", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.001", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.001", - "score": 3, + "techniqueID": "T1038", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1529", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1067", - "score": 3, + "techniqueID": "T1003.005", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1542.003", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1080", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1587.002", - "score": 3, + "techniqueID": "T1071.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1091", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.001", - "score": 3, - "showSubtechniques": false + "techniqueID": "T1039", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1572", - "score": 3, + "techniqueID": "T1055.012", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1004", - "score": 3, - "showSubtechniques": false + "techniqueID": "T1036.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1071.003", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1021.006", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1547.004", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1550.003", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1188", + "techniqueID": "T1518", "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + }, + { + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1074", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1104", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.006", - "score": 3, + "techniqueID": "T1014", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1072", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1210", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1199", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1069.001", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1097", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.003", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.006", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1486", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1573", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1028", - "score": 3, + "techniqueID": "T1003.005", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1027.004", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1197", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1585", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + "techniqueID": "T1071.002", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1500", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1485", + "techniqueID": "T1039", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1498", - "score": -1, + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.003", + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1588.003", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1008", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1053.002", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.001", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.001", + "techniqueID": "T1518", "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + }, + { + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1529", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1067", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1542.003", - "score": 3, + "techniqueID": "T1014", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1080", - "score": 3, + "techniqueID": "T1560.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1587.002", - "score": 3, + "techniqueID": "T1025", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1091", - "score": 3, + "techniqueID": "T1093", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.001", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1572", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1004", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1071.003", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1021.006", - "score": 3, + "techniqueID": "T1038", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1547.004", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1550.003", - "score": 3, + "techniqueID": "T1003.005", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1188", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1074", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1104", - "score": 3, + "techniqueID": "T1071.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.006", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1072", - "score": 2, + "techniqueID": "T1039", + "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1210", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1199", - "score": 2, + "techniqueID": "T1036.003", + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1069.001", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1097", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.003", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.006", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1486", - "score": -1, + "techniqueID": "T1518", + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" }, { - "techniqueID": "T1573", - "score": 3, - "showSubtechniques": false + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { - "techniqueID": "T1028", - "score": 3, + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1027.004", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1197", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1585", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1500", - "score": 3, + "techniqueID": "T1560.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1485", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1588.003", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1008", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1053.002", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.001", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.001", - "score": 3, + "techniqueID": "T1038", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1529", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1067", - "score": 3, + "techniqueID": "T1003.005", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1542.003", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1080", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1587.002", - "score": 3, + "techniqueID": "T1071.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1091", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.001", - "score": 3, - "showSubtechniques": false + "techniqueID": "T1039", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1572", - "score": 3, + "techniqueID": "T1055.012", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1004", - "score": 3, - "showSubtechniques": false + "techniqueID": "T1036.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1071.003", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1021.006", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1547.004", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1550.003", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1188", + "techniqueID": "T1518", "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + }, + { + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1074", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1104", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.006", - "score": 3, + "techniqueID": "T1014", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1072", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1210", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1199", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1069.001", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1097", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.003", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.006", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1486", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1573", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1028", - "score": 3, + "techniqueID": "T1003.005", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1027.004", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1197", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1585", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + "techniqueID": "T1071.002", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1500", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1485", + "techniqueID": "T1039", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1498", - "score": -1, + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.003", + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1588.003", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1008", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1053.002", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.001", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.001", + "techniqueID": "T1518", "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + }, + { + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1529", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1067", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1542.003", - "score": 3, + "techniqueID": "T1014", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1080", - "score": 3, + "techniqueID": "T1560.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1587.002", - "score": 3, + "techniqueID": "T1025", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1091", - "score": 3, + "techniqueID": "T1093", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.001", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1572", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1004", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1071.003", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1021.006", - "score": 3, + "techniqueID": "T1038", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1547.004", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1550.003", - "score": 3, + "techniqueID": "T1003.005", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1188", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1074", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1104", - "score": 3, + "techniqueID": "T1071.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.006", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1072", - "score": 2, + "techniqueID": "T1039", + "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1210", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1199", - "score": 2, + "techniqueID": "T1036.003", + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1069.001", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1097", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.003", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.006", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1486", - "score": -1, + "techniqueID": "T1518", + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" }, { - "techniqueID": "T1573", - "score": 3, - "showSubtechniques": false + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { - "techniqueID": "T1028", - "score": 3, + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1027.004", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1197", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1585", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1500", - "score": 3, + "techniqueID": "T1560.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1485", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1588.003", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1008", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1053.002", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.001", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.001", - "score": 3, + "techniqueID": "T1038", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1529", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1067", - "score": 3, + "techniqueID": "T1003.005", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1542.003", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1080", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1587.002", - "score": 3, + "techniqueID": "T1071.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1091", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.001", - "score": 3, - "showSubtechniques": false + "techniqueID": "T1039", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1572", - "score": 3, + "techniqueID": "T1055.012", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1004", - "score": 3, - "showSubtechniques": false + "techniqueID": "T1036.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1071.003", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1021.006", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1547.004", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1550.003", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1188", + "techniqueID": "T1518", "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + }, + { + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1074", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1104", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.006", - "score": 3, + "techniqueID": "T1014", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1072", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1210", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1199", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1069.001", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1097", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.003", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.006", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1486", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1573", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1028", - "score": 3, + "techniqueID": "T1003.005", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1027.004", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1197", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1585", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + "techniqueID": "T1071.002", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1500", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1485", + "techniqueID": "T1039", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1498", - "score": -1, + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.003", + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1588.003", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1008", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1053.002", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.001", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.001", + "techniqueID": "T1518", "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + }, + { + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1529", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1067", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1542.003", - "score": 3, + "techniqueID": "T1014", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1080", - "score": 3, + "techniqueID": "T1560.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1587.002", - "score": 3, + "techniqueID": "T1025", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1091", - "score": 3, + "techniqueID": "T1093", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.001", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1572", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1004", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1071.003", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1021.006", - "score": 3, + "techniqueID": "T1038", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1547.004", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1550.003", - "score": 3, + "techniqueID": "T1003.005", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1188", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1074", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1104", - "score": 3, + "techniqueID": "T1071.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.006", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1072", - "score": 2, + "techniqueID": "T1039", + "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1210", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1199", - "score": 2, + "techniqueID": "T1036.003", + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1069.001", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1097", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.003", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.006", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1486", - "score": -1, + "techniqueID": "T1518", + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" }, { - "techniqueID": "T1573", - "score": 3, - "showSubtechniques": false + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { - "techniqueID": "T1028", - "score": 3, + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1027.004", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1197", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1585", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1500", - "score": 3, + "techniqueID": "T1560.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1485", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1588.003", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1008", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1053.002", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.001", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.001", - "score": 3, + "techniqueID": "T1038", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1529", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1067", - "score": 3, + "techniqueID": "T1003.005", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1542.003", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1080", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1587.002", - "score": 3, + "techniqueID": "T1071.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1091", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.001", - "score": 3, - "showSubtechniques": false + "techniqueID": "T1039", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1572", - "score": 3, + "techniqueID": "T1055.012", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1004", - "score": 3, - "showSubtechniques": false + "techniqueID": "T1036.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1071.003", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1021.006", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1547.004", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1550.003", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1188", + "techniqueID": "T1518", "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + }, + { + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1074", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1104", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.006", - "score": 3, + "techniqueID": "T1014", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1072", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1210", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1199", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1069.001", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1097", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.003", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.006", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1486", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1573", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1028", - "score": 3, + "techniqueID": "T1003.005", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1027.004", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1197", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1585", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + "techniqueID": "T1071.002", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1500", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1485", + "techniqueID": "T1039", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1498", - "score": -1, + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.003", + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1588.003", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1008", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1053.002", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.001", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.001", + "techniqueID": "T1518", "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + }, + { + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1529", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1067", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1542.003", - "score": 3, + "techniqueID": "T1014", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1080", - "score": 3, + "techniqueID": "T1560.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1587.002", - "score": 3, + "techniqueID": "T1025", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1091", - "score": 3, + "techniqueID": "T1093", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.001", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1572", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1004", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1071.003", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1021.006", - "score": 3, + "techniqueID": "T1038", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1547.004", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1550.003", - "score": 3, + "techniqueID": "T1003.005", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1188", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1074", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1104", - "score": 3, + "techniqueID": "T1071.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.006", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1072", - "score": 2, + "techniqueID": "T1039", + "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1210", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1199", - "score": 2, + "techniqueID": "T1036.003", + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1069.001", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1097", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.003", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.006", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1486", - "score": -1, + "techniqueID": "T1518", + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" }, { - "techniqueID": "T1573", - "score": 3, - "showSubtechniques": false + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { - "techniqueID": "T1028", - "score": 3, + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1027.004", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1197", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1585", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1500", - "score": 3, + "techniqueID": "T1560.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1485", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1588.003", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1008", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1053.002", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.001", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.001", - "score": 3, + "techniqueID": "T1038", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1529", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1067", - "score": 3, + "techniqueID": "T1003.005", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1542.003", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1080", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1587.002", - "score": 3, + "techniqueID": "T1071.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1091", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.001", - "score": 3, - "showSubtechniques": false + "techniqueID": "T1039", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1572", - "score": 3, + "techniqueID": "T1055.012", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1004", - "score": 3, - "showSubtechniques": false + "techniqueID": "T1036.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1071.003", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1021.006", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1547.004", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1550.003", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1188", + "techniqueID": "T1518", "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + }, + { + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1074", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1104", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.006", - "score": 3, + "techniqueID": "T1014", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1072", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1210", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1199", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1069.001", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1097", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.003", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.006", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1486", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1573", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1028", - "score": 3, + "techniqueID": "T1003.005", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1027.004", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1197", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1585", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + "techniqueID": "T1071.002", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1500", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1485", + "techniqueID": "T1039", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1498", - "score": -1, + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.003", + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1588.003", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1008", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1053.002", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.001", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.001", + "techniqueID": "T1518", "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + }, + { + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1529", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1067", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1542.003", - "score": 3, + "techniqueID": "T1014", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1080", - "score": 3, + "techniqueID": "T1560.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1587.002", - "score": 3, + "techniqueID": "T1025", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1091", - "score": 3, + "techniqueID": "T1093", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.001", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1572", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1004", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1071.003", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1021.006", - "score": 3, + "techniqueID": "T1038", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1547.004", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1550.003", - "score": 3, + "techniqueID": "T1003.005", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1188", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1074", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1104", - "score": 3, + "techniqueID": "T1071.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.006", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1072", - "score": 2, + "techniqueID": "T1039", + "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1210", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1199", - "score": 2, + "techniqueID": "T1036.003", + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1069.001", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1097", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.003", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.006", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1486", - "score": -1, + "techniqueID": "T1518", + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" }, { - "techniqueID": "T1573", - "score": 3, - "showSubtechniques": false + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { - "techniqueID": "T1028", - "score": 3, + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1027.004", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1197", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1585", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + "techniqueID": "T1014", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1500", - "score": 3, + "techniqueID": "T1560.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1485", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" + "techniqueID": "T1025", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1588.003", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1008", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1053.002", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.001", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.001", - "score": 3, + "techniqueID": "T1038", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1529", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1067", - "score": 3, + "techniqueID": "T1003.005", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1542.003", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1080", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1587.002", - "score": 3, + "techniqueID": "T1071.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1091", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.001", - "score": 3, + "techniqueID": "T1039", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1055.012", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1572", - "score": 3, + "techniqueID": "T1036.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + }, + { + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1004", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1071.003", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1021.006", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1547.004", + "techniqueID": "T1518", "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + }, + { + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1550.003", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1188", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1074", - "score": 3, + "techniqueID": "T1014", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1104", - "score": 3, + "techniqueID": "T1560.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.006", - "score": 3, + "techniqueID": "T1025", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1072", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1210", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" + "techniqueID": "T1110.002", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1199", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1069.001", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1097", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.003", - "score": 3, + "techniqueID": "T1038", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.006", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1486", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1573", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1028", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1027.004", - "score": 3, + "techniqueID": "T1071.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1197", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1585", - "score": 2, + "techniqueID": "T1039", + "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1500", - "score": 3, + "techniqueID": "T1055.012", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1485", - "score": 1, + "techniqueID": "T1036.003", + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1588.003", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1008", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1053.002", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.001", + "techniqueID": "T1518", "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + }, + { + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.001", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1529", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1067", - "score": 3, + "techniqueID": "T1014", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1542.003", - "score": 3, + "techniqueID": "T1560.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1080", - "score": 3, + "techniqueID": "T1025", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1587.002", - "score": 3, + "techniqueID": "T1093", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1091", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.001", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1572", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1004", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1071.003", - "score": 3, + "techniqueID": "T1038", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1021.006", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1547.004", - "score": 3, + "techniqueID": "T1003.005", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1550.003", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1188", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1074", - "score": 3, + "techniqueID": "T1071.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1104", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.006", - "score": 3, + "techniqueID": "T1039", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1055.012", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1072", - "score": 2, + "techniqueID": "T1036.003", + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1210", - "score": 2, + "techniqueID": "T1570", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1095", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1496", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1213", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1518", + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" }, { - "techniqueID": "T1199", - "score": 2, + "techniqueID": "T1003.003", + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" }, { - "techniqueID": "T1069.001", - "score": 3, + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1097", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.003", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.006", - "score": 3, + "techniqueID": "T1014", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1486", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1573", - "score": 3, + "techniqueID": "T1025", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1028", - "score": 3, + "techniqueID": "T1093", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1027.004", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1197", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1585", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1500", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1485", + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1110.003", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1568", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1071.002", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1039", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1498", - "score": -1, + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.003", + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1588.003", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1008", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1053.002", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.001", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.001", + "techniqueID": "T1518", "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + }, + { + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1529", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1067", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1542.003", - "score": 3, + "techniqueID": "T1014", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1080", - "score": 3, + "techniqueID": "T1560.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1587.002", - "score": 3, + "techniqueID": "T1025", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1091", - "score": 3, + "techniqueID": "T1093", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.001", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1572", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1004", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1071.003", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1021.006", - "score": 3, + "techniqueID": "T1038", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1547.004", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1550.003", - "score": 3, + "techniqueID": "T1003.005", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1188", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1074", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1104", - "score": 3, + "techniqueID": "T1071.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.006", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1072", - "score": 2, + "techniqueID": "T1039", + "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1210", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1199", - "score": 2, + "techniqueID": "T1036.003", + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1069.001", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1097", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.003", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.006", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1486", - "score": -1, + "techniqueID": "T1518", + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" }, { - "techniqueID": "T1573", - "score": 3, + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + }, + { + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1028", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1027.004", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1197", - "score": 3, + "techniqueID": "T1014", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1585", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1500", - "score": 3, + "techniqueID": "T1025", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1485", + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1110.002", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1110.003", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1568", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1071.002", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1039", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1498", - "score": -1, + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.003", + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1588.003", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1008", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1053.002", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.001", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.001", + "techniqueID": "T1518", "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + }, + { + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1529", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1067", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1542.003", - "score": 3, + "techniqueID": "T1014", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1080", - "score": 3, + "techniqueID": "T1560.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1587.002", - "score": 3, + "techniqueID": "T1025", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1091", - "score": 3, + "techniqueID": "T1093", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.001", - "score": 3, + "techniqueID": "T1110.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1572", - "score": 3, + "techniqueID": "T1487", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1004", - "score": 3, + "techniqueID": "T1574.001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1071.003", - "score": 3, + "techniqueID": "T1195", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1021.006", - "score": 3, + "techniqueID": "T1038", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1547.004", - "score": 3, + "techniqueID": "T1110.003", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1550.003", - "score": 3, + "techniqueID": "T1003.005", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1188", - "score": 3, + "techniqueID": "T1036.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1074", - "score": 3, + "techniqueID": "T1568", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1104", - "score": 3, + "techniqueID": "T1071.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1583.006", - "score": 3, + "techniqueID": "T1001", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1072", - "score": 2, + "techniqueID": "T1039", + "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1210", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1199", - "score": 2, + "techniqueID": "T1036.003", + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1069.001", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1097", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.003", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.006", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1486", - "score": -1, + "techniqueID": "T1518", + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" }, { - "techniqueID": "T1573", - "score": 3, + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + }, + { + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1028", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1027.004", - "score": 3, + "techniqueID": "T1561.002", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1197", - "score": 3, + "techniqueID": "T1014", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1585", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + "techniqueID": "T1560.003", + "score": 4, + "showSubtechniques": false }, { - "techniqueID": "T1500", - "score": 3, + "techniqueID": "T1025", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1485", + "techniqueID": "T1093", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1110.002", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1487", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1574.001", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1195", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1038", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1110.003", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1003.005", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.002", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1568", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1071.002", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1001", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1039", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1498", - "score": -1, + "techniqueID": "T1055.012", + "score": 4, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.003", + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { - "techniqueID": "T1588.003", - "score": 3, + "techniqueID": "T1570", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1008", - "score": 3, + "techniqueID": "T1095", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1053.002", - "score": 3, + "techniqueID": "T1496", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1090.001", - "score": 3, + "techniqueID": "T1213", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1584.001", + "techniqueID": "T1518", "score": 3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1003.003", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml" + }, + { + "techniqueID": "T1124", + "score": 4, "showSubtechniques": false }, { - "techniqueID": "T1529", - "score": 3, + "techniqueID": "T1094", + "score": 4, "showSubtechniques": false }, { @@ -357938,9 +353927,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -358135,9 +354123,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -358332,9 +354319,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -358529,9 +354515,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -358726,9 +354711,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -358923,9 +354907,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -359120,9 +355103,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -359317,9 +355299,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -359514,9 +355495,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -359711,9 +355691,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -359908,9 +355887,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -360105,9 +356083,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -360302,9 +356279,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -360499,9 +356475,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -360696,9 +356671,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -360893,9 +356867,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -361090,9 +357063,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -361287,9 +357259,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -361484,9 +357455,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -361681,9 +357651,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -361878,9 +357847,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -362075,9 +358043,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -362272,9 +358239,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -362469,9 +358435,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -362666,9 +358631,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -362863,9 +358827,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -363060,9 +359023,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -363257,9 +359219,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -363454,9 +359415,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -363651,9 +359611,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -363848,9 +359807,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -364045,9 +360003,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -364242,9 +360199,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -364439,9 +360395,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -364636,9 +360591,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -364833,9 +360787,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -365030,9 +360983,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -365227,9 +361179,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -365424,9 +361375,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -365621,9 +361571,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -365818,9 +361767,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -366015,9 +361963,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -366212,9 +362159,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -366409,9 +362355,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -366606,9 +362551,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -366803,9 +362747,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -367000,9 +362943,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -367197,9 +363139,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -367394,9 +363335,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -367591,9 +363531,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -367788,9 +363727,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -367985,9 +363923,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -368182,9 +364119,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -368379,9 +364315,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -368576,9 +364511,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -368773,9 +364707,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -368970,9 +364903,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -369167,9 +365099,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -369364,9 +365295,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -369561,9 +365491,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -369758,9 +365687,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -369955,9 +365883,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -370152,9 +366079,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -370349,9 +366275,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -370546,9 +366471,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -370743,9 +366667,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -370940,9 +366863,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -371137,9 +367059,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -371334,9 +367255,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -371531,9 +367451,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -371728,9 +367647,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -371925,9 +367843,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -372122,9 +368039,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -372319,9 +368235,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -372516,9 +368431,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -372713,9 +368627,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -372910,9 +368823,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -373107,9 +369019,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -373304,9 +369215,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -373501,9 +369411,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -373698,9 +369607,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -373895,9 +369803,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -374092,9 +369999,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -374289,9 +370195,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -374486,9 +370391,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -374683,9 +370587,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -374880,9 +370783,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -375077,9 +370979,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -375274,9 +371175,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -375471,9 +371371,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -375668,9 +371567,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -375865,9 +371763,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -376062,9 +371959,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -376259,9 +372155,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -376456,9 +372351,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -376653,9 +372547,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -376850,9 +372743,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -377047,9 +372939,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -377244,9 +373135,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -377441,9 +373331,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -377638,9 +373527,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -377835,9 +373723,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -378032,9 +373919,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -378229,9 +374115,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -378426,9 +374311,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -378623,9 +374507,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -378820,9 +374703,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -379017,9 +374899,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -379214,9 +375095,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -379411,9 +375291,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -379608,9 +375487,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -379805,9 +375683,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -380002,9 +375879,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -380199,9 +376075,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -380396,9 +376271,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -380593,9 +376467,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -380790,9 +376663,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -380987,9 +376859,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -381184,9 +377055,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -381381,9 +377251,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -381578,9 +377447,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -381775,9 +377643,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -381972,9 +377839,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -382169,9 +378035,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -382366,9 +378231,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -382563,9 +378427,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -382760,9 +378623,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -382957,9 +378819,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -383154,9 +379015,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -383351,9 +379211,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -383548,9 +379407,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -383745,9 +379603,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -383942,9 +379799,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -384139,9 +379995,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -384336,9 +380191,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -384533,9 +380387,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -384730,9 +380583,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -384927,9 +380779,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -385124,9 +380975,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -385321,9 +381171,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -385518,9 +381367,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -385715,9 +381563,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -385912,9 +381759,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -386109,9 +381955,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -386306,9 +382151,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -386503,9 +382347,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -386700,9 +382543,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -386897,9 +382739,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -387094,9 +382935,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -387291,9 +383131,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -387488,9 +383327,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -387685,9 +383523,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -387882,9 +383719,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -388079,9 +383915,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -388276,9 +384111,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -388473,9 +384307,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -388670,9 +384503,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -388867,9 +384699,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -389064,9 +384895,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -389261,9 +385091,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -389458,9 +385287,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -389655,9 +385483,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -389852,9 +385679,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -390049,9 +385875,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -390246,9 +386071,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -390443,9 +386267,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -390640,9 +386463,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -390837,9 +386659,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -391034,9 +386855,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -391231,9 +387051,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -391428,9 +387247,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -391625,9 +387443,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -391822,9 +387639,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -392019,9 +387835,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -392216,9 +388031,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -392413,9 +388227,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -392610,9 +388423,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -392807,9 +388619,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -393004,9 +388815,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -393201,9 +389011,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -393398,9 +389207,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -393595,9 +389403,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -393792,9 +389599,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -393989,9 +389795,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -394186,9 +389991,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -394383,9 +390187,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -394580,9 +390383,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -394777,9 +390579,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -394974,9 +390775,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -395171,9 +390971,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -395368,9 +391167,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -395565,9 +391363,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -395762,9 +391559,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -395959,9 +391755,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -396156,9 +391951,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -396353,9 +392147,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -396550,9 +392343,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -396747,9 +392539,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -396944,9 +392735,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -397141,9 +392931,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -397338,9 +393127,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -397535,9 +393323,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -397732,9 +393519,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -397929,9 +393715,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -398126,9 +393911,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -398323,9 +394107,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -398520,9 +394303,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -398717,9 +394499,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -398914,9 +394695,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -399111,9 +394891,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -399308,9 +395087,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -399505,9 +395283,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -399702,9 +395479,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -399899,9 +395675,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -400096,9 +395871,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -400293,9 +396067,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -400490,9 +396263,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -400687,9 +396459,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -400884,9 +396655,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -401081,9 +396851,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -401278,9 +397047,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -401475,9 +397243,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -401672,9 +397439,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -401869,9 +397635,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -402066,9 +397831,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -402263,9 +398027,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -402460,9 +398223,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -402657,9 +398419,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -402854,9 +398615,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -403051,9 +398811,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -403248,9 +399007,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -403445,9 +399203,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -403642,9 +399399,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -403839,9 +399595,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -404036,9 +399791,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -404233,9 +399987,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -404430,9 +400183,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -404627,9 +400379,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -404824,9 +400575,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -405021,9 +400771,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -405218,9 +400967,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -405415,9 +401163,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -405612,9 +401359,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -405809,9 +401555,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -406006,9 +401751,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -406203,9 +401947,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -406400,9 +402143,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -406597,9 +402339,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -406794,9 +402535,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -406991,9 +402731,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -407188,9 +402927,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -407385,9 +403123,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -407582,9 +403319,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -407779,9 +403515,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -407976,9 +403711,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -408173,9 +403907,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -408370,9 +404103,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -408567,9 +404299,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -408764,9 +404495,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -408961,9 +404691,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -409158,9 +404887,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -409355,9 +405083,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -409552,9 +405279,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -409749,9 +405475,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -409946,9 +405671,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -410143,9 +405867,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -410340,9 +406063,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -410537,9 +406259,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -410734,9 +406455,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -410931,9 +406651,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -411128,9 +406847,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -411325,9 +407043,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -411522,9 +407239,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -411719,9 +407435,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -411916,9 +407631,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -412113,9 +407827,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -412310,9 +408023,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -412507,9 +408219,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -412704,9 +408415,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -412901,9 +408611,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -413098,9 +408807,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -413295,9 +409003,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -413492,9 +409199,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -413689,9 +409395,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -413886,9 +409591,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -414083,9 +409787,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -414280,9 +409983,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -414477,9 +410179,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -414674,9 +410375,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -414871,9 +410571,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -415068,9 +410767,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -415265,9 +410963,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -415462,9 +411159,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -415659,9 +411355,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -415856,9 +411551,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -416053,9 +411747,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -416250,9 +411943,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -416447,9 +412139,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -416644,9 +412335,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -416841,9 +412531,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -417038,9 +412727,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -417235,9 +412923,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -417432,9 +413119,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -417629,9 +413315,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -417826,9 +413511,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -418023,9 +413707,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -418220,9 +413903,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -418417,9 +414099,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -418614,9 +414295,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -418811,9 +414491,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -419008,9 +414687,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -419205,9 +414883,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -419402,9 +415079,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -419599,9 +415275,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -419796,9 +415471,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -419993,9 +415667,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -420190,9 +415863,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -420387,9 +416059,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -420584,9 +416255,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -420781,9 +416451,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -420978,9 +416647,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -421175,9 +416843,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -421372,9 +417039,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -421569,9 +417235,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -421766,9 +417431,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -421963,9 +417627,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -422160,9 +417823,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -422357,9 +418019,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -422554,9 +418215,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -422751,9 +418411,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -422948,9 +418607,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -423145,9 +418803,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -423342,9 +418999,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -423539,9 +419195,204 @@ }, { "techniqueID": "T1498", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.003", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1090.001", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.001", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1080", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.002", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.001", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1004", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1021.006", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1547.004", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.006", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.006", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1486", "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1028", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1585", + "score": 2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1485", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" + }, + { + "techniqueID": "T1498", + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -423736,9 +419587,204 @@ }, { "techniqueID": "T1498", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.003", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1090.001", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.001", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1080", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.002", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.001", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1004", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1021.006", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1547.004", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.006", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.006", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1486", "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1028", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1197", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1585", + "score": 2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1485", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" + }, + { + "techniqueID": "T1498", + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -423933,9 +419979,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -424130,9 +420175,8 @@ }, { "techniqueID": "T1498", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 3, + "showSubtechniques": false }, { "techniqueID": "T1588.003", @@ -424165,6385 +420209,2553 @@ "showSubtechniques": false }, { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1213.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1565.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, - { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1115", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.007", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1176", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1032", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1087.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1562.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1145", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1552.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1134.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1125", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1191", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1055.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1208", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" - }, - { - "techniqueID": "T1187", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1567.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1564.005", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1098.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1037.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1480.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, - { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1213.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1565.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, - { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1115", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.007", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1176", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1032", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1087.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1562.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1145", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1552.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1134.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1125", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1191", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1055.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1208", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" - }, - { - "techniqueID": "T1187", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1567.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1564.005", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1098.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1037.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1480.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, - { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1213.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1565.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, - { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1115", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.007", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1176", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1032", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1087.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1562.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1145", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1552.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1134.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1125", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1191", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1055.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1208", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" - }, - { - "techniqueID": "T1187", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1567.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1564.005", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1098.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1037.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1480.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, - { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1213.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1565.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, - { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1115", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.007", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1176", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1032", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1087.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1562.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1145", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1552.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1134.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1125", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1191", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1055.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1208", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" - }, - { - "techniqueID": "T1187", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1567.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1564.005", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1098.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1037.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1480.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, - { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1213.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1565.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, - { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1115", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.007", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1176", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1032", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1087.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1562.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1145", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1552.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1134.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1125", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1191", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1055.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1208", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" - }, - { - "techniqueID": "T1187", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1567.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1564.005", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1098.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1037.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1480.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, - { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1213.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1565.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, - { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1115", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.007", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1176", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1032", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1087.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1562.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1145", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1552.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1134.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1125", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1191", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1055.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1208", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" - }, - { - "techniqueID": "T1187", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1567.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1564.005", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1098.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1037.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1480.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, - { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1213.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1565.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, - { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1115", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.007", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1176", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1032", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1087.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1562.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1145", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1552.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1134.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1125", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1191", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1055.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1208", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" - }, - { - "techniqueID": "T1187", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1567.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1564.005", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1098.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1037.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1480.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, - { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1213.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1565.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, - { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1115", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.007", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1176", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1032", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1087.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1562.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1145", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1552.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1134.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1125", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1191", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1055.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1208", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" - }, - { - "techniqueID": "T1187", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1567.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1564.005", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1098.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1037.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1480.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, - { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1213.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1565.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, - { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1115", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.007", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1176", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1032", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1087.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1562.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1145", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1552.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1134.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1125", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1191", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1055.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1208", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" - }, - { - "techniqueID": "T1187", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1567.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1564.005", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1098.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1037.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1480.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, - { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1213.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1565.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, - { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1115", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.007", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1176", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1032", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1087.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1562.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1145", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1552.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1134.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1125", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1191", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1055.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1208", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" - }, - { - "techniqueID": "T1187", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1567.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1564.005", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1098.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1037.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1480.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, - { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1213.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1565.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, - { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1115", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.007", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1176", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1032", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1087.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1562.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1145", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1552.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1134.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1125", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1191", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1055.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1208", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" - }, - { - "techniqueID": "T1187", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1567.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1564.005", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1098.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1037.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1480.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, - { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1213.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1565.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, - { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1115", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.007", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1176", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1032", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1087.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1562.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1145", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1552.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1134.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1125", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1191", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1055.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1208", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" - }, - { - "techniqueID": "T1187", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1567.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1564.005", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1098.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1037.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1480.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, - { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1213.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1565.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, - { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1115", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.007", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1176", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1032", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1087.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1562.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1145", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1552.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1134.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1125", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1191", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1055.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1208", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" - }, - { - "techniqueID": "T1187", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1567.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1564.005", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1098.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1037.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1480.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, - { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1213.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1565.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, - { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1115", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.007", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1176", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1032", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1087.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1562.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1145", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1552.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1134.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1125", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1191", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1055.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1208", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" - }, - { - "techniqueID": "T1187", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1567.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1564.005", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1098.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1037.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1480.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, - { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1213.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1565.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, - { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1115", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.007", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1176", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1032", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1087.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1562.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1145", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1552.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1134.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1125", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1191", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1055.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1208", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" - }, - { - "techniqueID": "T1187", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1567.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1564.005", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1098.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1037.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1480.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, - { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1213.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1565.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, - { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1115", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.007", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1176", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1032", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1087.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1562.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1145", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1552.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1134.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1125", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1191", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1055.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1059.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1208", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" - }, - { - "techniqueID": "T1187", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1567.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1564.005", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1098.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1037.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1480.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, - { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1213.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1565.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, - { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1115", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.007", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1176", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1032", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1087.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1562.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1145", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1552.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.004", - "score": 2, + "techniqueID": "T1067", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1134.002", - "score": 2, + "techniqueID": "T1542.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1125", - "score": 2, + "techniqueID": "T1080", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, + "techniqueID": "T1587.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.003", - "score": 2, + "techniqueID": "T1091", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1191", - "score": 2, + "techniqueID": "T1583.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1055.002", - "score": 2, + "techniqueID": "T1572", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1059.004", - "score": 2, + "techniqueID": "T1004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1208", - "score": 2, + "techniqueID": "T1071.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1036.001", - "score": 2, + "techniqueID": "T1021.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" - }, - { - "techniqueID": "T1187", - "score": 2, + "techniqueID": "T1547.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1567.002", - "score": 2, + "techniqueID": "T1550.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1564.005", - "score": 2, + "techniqueID": "T1188", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.004", - "score": 2, + "techniqueID": "T1074", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1098.002", - "score": 2, + "techniqueID": "T1104", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1037.001", - "score": 2, + "techniqueID": "T1583.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1480.001", + "techniqueID": "T1072", "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1558.003", - "score": 0, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, - { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1213.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.003", - "score": 2, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1565.001", + "techniqueID": "T1210", "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1114.001", - "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, - { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1115", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.007", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1176", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1032", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1087.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1562.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1145", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1552.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1134.002", - "score": 2, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" }, { - "techniqueID": "T1125", + "techniqueID": "T1199", "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1482", - "score": 0, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1191", - "score": 2, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { - "techniqueID": "T1055.002", - "score": 2, + "techniqueID": "T1069.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1059.004", - "score": 2, + "techniqueID": "T1097", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1208", - "score": 2, + "techniqueID": "T1090.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1036.001", - "score": 2, + "techniqueID": "T1584.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1201", - "score": 1, + "techniqueID": "T1486", + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" - }, - { - "techniqueID": "T1187", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1567.002", - "score": 2, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" }, { - "techniqueID": "T1564.005", - "score": 2, + "techniqueID": "T1573", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.004", - "score": 2, + "techniqueID": "T1028", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1098.002", - "score": 2, + "techniqueID": "T1027.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1037.001", - "score": 2, + "techniqueID": "T1197", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1480.001", + "techniqueID": "T1585", "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1558.003", - "score": 0, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, - { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1213.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.004", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.003", - "score": 2, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" }, { - "techniqueID": "T1565.001", - "score": 2, + "techniqueID": "T1500", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, - { - "techniqueID": "T1489", + "techniqueID": "T1485", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.001", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1115", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1218.007", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1176", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1560.002", - "score": 2, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" }, { - "techniqueID": "T1032", - "score": 2, + "techniqueID": "T1498", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1087.003", - "score": 2, + "techniqueID": "T1588.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.003", - "score": 2, + "techniqueID": "T1008", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1562.002", - "score": 2, + "techniqueID": "T1053.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1145", - "score": 2, + "techniqueID": "T1090.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1552.004", - "score": 2, + "techniqueID": "T1584.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.004", - "score": 2, + "techniqueID": "T1529", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1134.002", - "score": 2, + "techniqueID": "T1067", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1125", - "score": 2, + "techniqueID": "T1542.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "techniqueID": "T1080", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1542.002", - "score": 2, + "techniqueID": "T1587.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.003", - "score": 2, + "techniqueID": "T1091", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1191", - "score": 2, + "techniqueID": "T1583.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1055.002", - "score": 2, + "techniqueID": "T1572", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1059.004", - "score": 2, + "techniqueID": "T1004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1208", - "score": 2, + "techniqueID": "T1071.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1036.001", - "score": 2, + "techniqueID": "T1021.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + "techniqueID": "T1547.004", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1187", - "score": 2, + "techniqueID": "T1550.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1567.002", - "score": 2, + "techniqueID": "T1188", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1564.005", - "score": 2, + "techniqueID": "T1074", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.004", - "score": 2, + "techniqueID": "T1104", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1098.002", - "score": 2, + "techniqueID": "T1583.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1037.001", + "techniqueID": "T1072", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1480.001", + "techniqueID": "T1210", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" }, { - "techniqueID": "T1558.003", - "score": 0, + "techniqueID": "T1199", + "score": 2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { - "techniqueID": "T1596.003", - "score": 2, + "techniqueID": "T1069.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1222.002", - "score": 2, + "techniqueID": "T1097", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1492", - "score": 2, + "techniqueID": "T1090.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1213.002", - "score": 2, + "techniqueID": "T1584.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1109", - "score": 2, + "techniqueID": "T1486", + "score": -1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + }, + { + "techniqueID": "T1573", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1588.004", - "score": 2, + "techniqueID": "T1028", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1587.003", - "score": 2, + "techniqueID": "T1027.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1565.001", - "score": 2, + "techniqueID": "T1197", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1114.001", - "score": 1, + "techniqueID": "T1585", + "score": 2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" }, { - "techniqueID": "T1489", + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1485", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" }, { - "techniqueID": "T1568.001", - "score": 2, + "techniqueID": "T1498", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1559.001", - "score": 2, + "techniqueID": "T1588.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1115", - "score": 2, + "techniqueID": "T1008", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.007", - "score": 2, + "techniqueID": "T1053.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1176", - "score": 2, + "techniqueID": "T1090.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.003", - "score": 2, + "techniqueID": "T1584.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1560.002", - "score": 2, + "techniqueID": "T1529", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1032", - "score": 2, + "techniqueID": "T1067", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1087.003", - "score": 2, + "techniqueID": "T1542.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.003", - "score": 2, + "techniqueID": "T1080", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1562.002", - "score": 2, + "techniqueID": "T1587.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1145", - "score": 2, + "techniqueID": "T1091", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1552.004", - "score": 2, + "techniqueID": "T1583.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.004", - "score": 2, + "techniqueID": "T1572", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1134.002", - "score": 2, + "techniqueID": "T1004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1125", - "score": 2, + "techniqueID": "T1071.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "techniqueID": "T1021.006", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1542.002", - "score": 2, + "techniqueID": "T1547.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.003", - "score": 2, + "techniqueID": "T1550.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1191", - "score": 2, + "techniqueID": "T1188", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1055.002", - "score": 2, + "techniqueID": "T1074", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1059.004", - "score": 2, + "techniqueID": "T1104", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1208", - "score": 2, + "techniqueID": "T1583.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1036.001", + "techniqueID": "T1072", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1201", - "score": 1, + "techniqueID": "T1210", + "score": 2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" }, { - "techniqueID": "T1187", + "techniqueID": "T1199", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { - "techniqueID": "T1567.002", - "score": 2, + "techniqueID": "T1069.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1564.005", - "score": 2, + "techniqueID": "T1097", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.004", - "score": 2, + "techniqueID": "T1090.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1098.002", - "score": 2, + "techniqueID": "T1584.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1037.001", - "score": 2, - "showSubtechniques": false + "techniqueID": "T1486", + "score": -1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" }, { - "techniqueID": "T1480.001", - "score": 2, + "techniqueID": "T1573", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + "techniqueID": "T1028", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1596.003", - "score": 2, + "techniqueID": "T1027.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1222.002", - "score": 2, + "techniqueID": "T1197", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1492", + "techniqueID": "T1585", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" }, { - "techniqueID": "T1213.002", - "score": 2, + "techniqueID": "T1500", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false + "techniqueID": "T1485", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" }, { - "techniqueID": "T1588.004", - "score": 2, + "techniqueID": "T1498", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1587.003", - "score": 2, + "techniqueID": "T1588.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1565.001", - "score": 2, + "techniqueID": "T1008", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + "techniqueID": "T1090.001", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1568.001", - "score": 2, + "techniqueID": "T1584.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1559.001", - "score": 2, + "techniqueID": "T1529", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1115", - "score": 2, + "techniqueID": "T1067", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.007", - "score": 2, + "techniqueID": "T1542.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1176", - "score": 2, + "techniqueID": "T1080", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.003", - "score": 2, + "techniqueID": "T1587.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1560.002", - "score": 2, + "techniqueID": "T1091", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1032", - "score": 2, + "techniqueID": "T1583.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1087.003", - "score": 2, + "techniqueID": "T1572", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.003", - "score": 2, + "techniqueID": "T1004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1562.002", - "score": 2, + "techniqueID": "T1071.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1145", - "score": 2, + "techniqueID": "T1021.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1552.004", - "score": 2, + "techniqueID": "T1547.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.004", - "score": 2, + "techniqueID": "T1550.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1134.002", - "score": 2, + "techniqueID": "T1188", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1125", - "score": 2, + "techniqueID": "T1074", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1542.002", - "score": 2, + "techniqueID": "T1583.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.003", + "techniqueID": "T1072", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1191", + "techniqueID": "T1210", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" }, { - "techniqueID": "T1055.002", + "techniqueID": "T1199", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { - "techniqueID": "T1059.004", - "score": 2, + "techniqueID": "T1069.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1208", - "score": 2, + "techniqueID": "T1097", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1036.001", - "score": 2, + "techniqueID": "T1090.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + "techniqueID": "T1584.006", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1187", - "score": 2, - "showSubtechniques": false + "techniqueID": "T1486", + "score": -1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" }, { - "techniqueID": "T1567.002", - "score": 2, + "techniqueID": "T1573", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1564.005", - "score": 2, + "techniqueID": "T1028", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.004", - "score": 2, + "techniqueID": "T1027.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1098.002", - "score": 2, + "techniqueID": "T1197", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1037.001", + "techniqueID": "T1585", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" }, { - "techniqueID": "T1480.001", - "score": 2, + "techniqueID": "T1500", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1558.003", - "score": 0, + "techniqueID": "T1485", + "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" }, { - "techniqueID": "T1596.003", - "score": 2, + "techniqueID": "T1498", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1222.002", - "score": 2, + "techniqueID": "T1588.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1492", - "score": 2, + "techniqueID": "T1008", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1213.002", - "score": 2, + "techniqueID": "T1053.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1109", - "score": 2, + "techniqueID": "T1090.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1588.004", - "score": 2, + "techniqueID": "T1584.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1587.003", - "score": 2, + "techniqueID": "T1529", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1565.001", - "score": 2, + "techniqueID": "T1067", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" - }, - { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1568.001", - "score": 2, + "techniqueID": "T1080", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1559.001", - "score": 2, + "techniqueID": "T1587.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1115", - "score": 2, + "techniqueID": "T1091", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.007", - "score": 2, + "techniqueID": "T1583.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1176", - "score": 2, + "techniqueID": "T1572", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.003", - "score": 2, + "techniqueID": "T1004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1560.002", - "score": 2, + "techniqueID": "T1071.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1032", - "score": 2, + "techniqueID": "T1021.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1087.003", - "score": 2, + "techniqueID": "T1547.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.003", - "score": 2, + "techniqueID": "T1550.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1562.002", - "score": 2, + "techniqueID": "T1188", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1145", - "score": 2, + "techniqueID": "T1074", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1552.004", - "score": 2, + "techniqueID": "T1104", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.004", - "score": 2, + "techniqueID": "T1583.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1134.002", + "techniqueID": "T1072", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1125", + "techniqueID": "T1210", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" }, { - "techniqueID": "T1482", - "score": 0, + "techniqueID": "T1199", + "score": 2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { - "techniqueID": "T1542.002", - "score": 2, + "techniqueID": "T1069.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.003", - "score": 2, + "techniqueID": "T1097", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1191", - "score": 2, + "techniqueID": "T1090.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1055.002", - "score": 2, + "techniqueID": "T1584.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1059.004", - "score": 2, - "showSubtechniques": false + "techniqueID": "T1486", + "score": -1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" }, { - "techniqueID": "T1208", - "score": 2, + "techniqueID": "T1573", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1036.001", - "score": 2, + "techniqueID": "T1028", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1187", - "score": 2, + "techniqueID": "T1197", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1567.002", + "techniqueID": "T1585", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" }, { - "techniqueID": "T1564.005", - "score": 2, + "techniqueID": "T1500", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.004", - "score": 2, - "showSubtechniques": false + "techniqueID": "T1485", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" }, { - "techniqueID": "T1098.002", - "score": 2, + "techniqueID": "T1498", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1037.001", - "score": 2, + "techniqueID": "T1588.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1480.001", - "score": 2, + "techniqueID": "T1008", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1596.003", - "score": 2, + "techniqueID": "T1090.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1222.002", - "score": 2, + "techniqueID": "T1584.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1492", - "score": 2, + "techniqueID": "T1529", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1213.002", - "score": 2, + "techniqueID": "T1067", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1109", - "score": 2, + "techniqueID": "T1542.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1588.004", - "score": 2, + "techniqueID": "T1080", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1587.003", - "score": 2, + "techniqueID": "T1587.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1565.001", - "score": 2, + "techniqueID": "T1091", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "techniqueID": "T1583.001", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1568.001", - "score": 2, + "techniqueID": "T1004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1559.001", - "score": 2, + "techniqueID": "T1071.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1115", - "score": 2, + "techniqueID": "T1021.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.007", - "score": 2, + "techniqueID": "T1547.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1176", - "score": 2, + "techniqueID": "T1550.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.003", - "score": 2, + "techniqueID": "T1188", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1560.002", - "score": 2, + "techniqueID": "T1074", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1032", - "score": 2, + "techniqueID": "T1104", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1087.003", - "score": 2, + "techniqueID": "T1583.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.003", + "techniqueID": "T1072", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1562.002", + "techniqueID": "T1210", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" }, { - "techniqueID": "T1145", + "techniqueID": "T1199", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { - "techniqueID": "T1552.004", - "score": 2, + "techniqueID": "T1069.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.004", - "score": 2, + "techniqueID": "T1097", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1134.002", - "score": 2, + "techniqueID": "T1090.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1125", - "score": 2, + "techniqueID": "T1584.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1482", - "score": 0, + "techniqueID": "T1486", + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" }, { - "techniqueID": "T1583.003", - "score": 2, + "techniqueID": "T1573", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1191", - "score": 2, + "techniqueID": "T1028", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1055.002", - "score": 2, + "techniqueID": "T1027.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1059.004", - "score": 2, + "techniqueID": "T1197", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1208", + "techniqueID": "T1585", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" }, { - "techniqueID": "T1036.001", - "score": 2, + "techniqueID": "T1500", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1201", + "techniqueID": "T1485", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" }, { - "techniqueID": "T1187", - "score": 2, + "techniqueID": "T1498", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1567.002", - "score": 2, + "techniqueID": "T1588.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1564.005", - "score": 2, + "techniqueID": "T1008", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.004", - "score": 2, + "techniqueID": "T1053.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1098.002", - "score": 2, + "techniqueID": "T1090.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1037.001", - "score": 2, + "techniqueID": "T1584.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1480.001", - "score": 2, + "techniqueID": "T1529", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1596.003", - "score": 2, + "techniqueID": "T1542.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1222.002", - "score": 2, + "techniqueID": "T1080", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1492", - "score": 2, + "techniqueID": "T1587.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1213.002", - "score": 2, + "techniqueID": "T1091", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1109", - "score": 2, + "techniqueID": "T1583.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1588.004", - "score": 2, + "techniqueID": "T1572", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1587.003", - "score": 2, + "techniqueID": "T1004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1565.001", - "score": 2, + "techniqueID": "T1071.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "techniqueID": "T1021.006", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + "techniqueID": "T1547.004", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1568.001", - "score": 2, + "techniqueID": "T1550.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1559.001", - "score": 2, + "techniqueID": "T1188", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1115", - "score": 2, + "techniqueID": "T1074", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.007", - "score": 2, + "techniqueID": "T1104", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1176", - "score": 2, + "techniqueID": "T1583.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.003", + "techniqueID": "T1072", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1560.002", + "techniqueID": "T1210", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" }, { - "techniqueID": "T1032", + "techniqueID": "T1199", "score": 2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1069.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1087.003", - "score": 2, + "techniqueID": "T1097", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.003", - "score": 2, + "techniqueID": "T1090.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1562.002", - "score": 2, + "techniqueID": "T1584.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1145", - "score": 2, + "techniqueID": "T1486", + "score": -1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + }, + { + "techniqueID": "T1573", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1552.004", - "score": 2, + "techniqueID": "T1028", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.004", - "score": 2, + "techniqueID": "T1027.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1134.002", - "score": 2, + "techniqueID": "T1197", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1125", + "techniqueID": "T1585", "score": 2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1500", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1482", - "score": 0, + "techniqueID": "T1485", + "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" }, { - "techniqueID": "T1542.002", - "score": 2, + "techniqueID": "T1498", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.003", - "score": 2, + "techniqueID": "T1588.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1191", - "score": 2, + "techniqueID": "T1008", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1055.002", - "score": 2, + "techniqueID": "T1053.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1059.004", - "score": 2, + "techniqueID": "T1090.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1208", - "score": 2, + "techniqueID": "T1584.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1036.001", - "score": 2, + "techniqueID": "T1529", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1187", - "score": 2, + "techniqueID": "T1542.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1567.002", - "score": 2, + "techniqueID": "T1080", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1564.005", - "score": 2, + "techniqueID": "T1587.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.004", - "score": 2, + "techniqueID": "T1091", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1098.002", - "score": 2, + "techniqueID": "T1583.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1037.001", - "score": 2, + "techniqueID": "T1572", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1480.001", - "score": 2, + "techniqueID": "T1004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1596.003", - "score": 2, + "techniqueID": "T1021.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1222.002", - "score": 2, + "techniqueID": "T1547.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1492", - "score": 2, + "techniqueID": "T1550.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1213.002", - "score": 2, + "techniqueID": "T1188", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1109", - "score": 2, + "techniqueID": "T1074", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1588.004", - "score": 2, + "techniqueID": "T1104", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1587.003", - "score": 2, + "techniqueID": "T1583.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1565.001", + "techniqueID": "T1072", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1114.001", - "score": 1, + "techniqueID": "T1210", + "score": 2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" }, { - "techniqueID": "T1489", - "score": 1, + "techniqueID": "T1199", + "score": 2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { - "techniqueID": "T1568.001", - "score": 2, + "techniqueID": "T1069.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1559.001", - "score": 2, + "techniqueID": "T1097", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1115", - "score": 2, + "techniqueID": "T1090.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.007", - "score": 2, + "techniqueID": "T1584.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1176", - "score": 2, - "showSubtechniques": false + "techniqueID": "T1486", + "score": -1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" }, { - "techniqueID": "T1584.003", - "score": 2, + "techniqueID": "T1573", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1560.002", - "score": 2, + "techniqueID": "T1028", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1032", - "score": 2, + "techniqueID": "T1027.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1087.003", - "score": 2, + "techniqueID": "T1197", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.003", + "techniqueID": "T1585", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" }, { - "techniqueID": "T1562.002", - "score": 2, + "techniqueID": "T1500", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1145", - "score": 2, - "showSubtechniques": false + "techniqueID": "T1485", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" }, { - "techniqueID": "T1552.004", - "score": 2, + "techniqueID": "T1498", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.004", - "score": 2, + "techniqueID": "T1588.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1134.002", - "score": 2, + "techniqueID": "T1008", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1125", - "score": 2, + "techniqueID": "T1053.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "techniqueID": "T1090.001", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1542.002", - "score": 2, + "techniqueID": "T1584.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.003", - "score": 2, + "techniqueID": "T1529", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1191", - "score": 2, + "techniqueID": "T1067", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1055.002", - "score": 2, + "techniqueID": "T1542.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1059.004", - "score": 2, + "techniqueID": "T1080", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1208", - "score": 2, + "techniqueID": "T1587.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1036.001", - "score": 2, + "techniqueID": "T1091", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + "techniqueID": "T1583.001", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1187", - "score": 2, + "techniqueID": "T1572", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1567.002", - "score": 2, + "techniqueID": "T1004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1564.005", - "score": 2, + "techniqueID": "T1071.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.004", - "score": 2, + "techniqueID": "T1021.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1098.002", - "score": 2, + "techniqueID": "T1547.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1037.001", - "score": 2, + "techniqueID": "T1550.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1480.001", - "score": 2, + "techniqueID": "T1188", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1596.003", - "score": 2, + "techniqueID": "T1104", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1222.002", - "score": 2, + "techniqueID": "T1583.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1492", + "techniqueID": "T1072", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1213.002", + "techniqueID": "T1210", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" }, { - "techniqueID": "T1109", + "techniqueID": "T1199", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { - "techniqueID": "T1588.004", - "score": 2, + "techniqueID": "T1069.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1587.003", - "score": 2, + "techniqueID": "T1097", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1565.001", - "score": 2, + "techniqueID": "T1090.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "techniqueID": "T1584.006", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1489", - "score": 1, + "techniqueID": "T1486", + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" }, { - "techniqueID": "T1568.001", - "score": 2, + "techniqueID": "T1573", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1559.001", - "score": 2, + "techniqueID": "T1028", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1115", - "score": 2, + "techniqueID": "T1027.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.007", - "score": 2, + "techniqueID": "T1197", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1176", + "techniqueID": "T1585", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" }, { - "techniqueID": "T1584.003", - "score": 2, + "techniqueID": "T1500", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1560.002", - "score": 2, - "showSubtechniques": false + "techniqueID": "T1485", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" }, { - "techniqueID": "T1032", - "score": 2, + "techniqueID": "T1498", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1087.003", - "score": 2, + "techniqueID": "T1588.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.003", - "score": 2, + "techniqueID": "T1008", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1562.002", - "score": 2, + "techniqueID": "T1053.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1145", - "score": 2, + "techniqueID": "T1090.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1552.004", - "score": 2, + "techniqueID": "T1584.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.004", - "score": 2, + "techniqueID": "T1529", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1134.002", - "score": 2, + "techniqueID": "T1067", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1125", - "score": 2, + "techniqueID": "T1542.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "techniqueID": "T1080", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1542.002", - "score": 2, + "techniqueID": "T1587.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.003", - "score": 2, + "techniqueID": "T1091", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1191", - "score": 2, + "techniqueID": "T1583.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1055.002", - "score": 2, + "techniqueID": "T1572", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1059.004", - "score": 2, + "techniqueID": "T1004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1208", - "score": 2, + "techniqueID": "T1071.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1036.001", - "score": 2, + "techniqueID": "T1021.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + "techniqueID": "T1547.004", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1187", - "score": 2, + "techniqueID": "T1550.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1567.002", - "score": 2, + "techniqueID": "T1188", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1564.005", - "score": 2, + "techniqueID": "T1074", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.004", - "score": 2, + "techniqueID": "T1104", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1098.002", - "score": 2, + "techniqueID": "T1583.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1037.001", + "techniqueID": "T1072", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1480.001", + "techniqueID": "T1210", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" }, { - "techniqueID": "T1558.003", - "score": 0, + "techniqueID": "T1199", + "score": 2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { - "techniqueID": "T1596.003", - "score": 2, + "techniqueID": "T1069.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1222.002", - "score": 2, + "techniqueID": "T1097", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1492", - "score": 2, + "techniqueID": "T1090.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1213.002", - "score": 2, + "techniqueID": "T1584.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1109", - "score": 2, + "techniqueID": "T1486", + "score": -1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + }, + { + "techniqueID": "T1573", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1588.004", - "score": 2, + "techniqueID": "T1028", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1587.003", - "score": 2, + "techniqueID": "T1027.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1565.001", - "score": 2, + "techniqueID": "T1197", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1114.001", - "score": 1, + "techniqueID": "T1585", + "score": 2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" }, { - "techniqueID": "T1489", + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1485", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" }, { - "techniqueID": "T1568.001", - "score": 2, + "techniqueID": "T1498", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1559.001", - "score": 2, + "techniqueID": "T1588.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1115", - "score": 2, + "techniqueID": "T1008", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.007", - "score": 2, + "techniqueID": "T1053.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1176", - "score": 2, + "techniqueID": "T1090.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.003", - "score": 2, + "techniqueID": "T1584.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1560.002", - "score": 2, + "techniqueID": "T1529", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1032", - "score": 2, + "techniqueID": "T1067", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1087.003", - "score": 2, + "techniqueID": "T1542.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.003", - "score": 2, + "techniqueID": "T1080", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1562.002", - "score": 2, + "techniqueID": "T1587.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1145", - "score": 2, + "techniqueID": "T1091", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1552.004", - "score": 2, + "techniqueID": "T1583.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.004", - "score": 2, + "techniqueID": "T1572", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1134.002", - "score": 2, + "techniqueID": "T1004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1125", - "score": 2, + "techniqueID": "T1071.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "techniqueID": "T1021.006", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1542.002", - "score": 2, + "techniqueID": "T1547.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.003", - "score": 2, + "techniqueID": "T1550.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1191", - "score": 2, + "techniqueID": "T1188", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1055.002", - "score": 2, + "techniqueID": "T1074", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1059.004", - "score": 2, + "techniqueID": "T1104", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1208", - "score": 2, + "techniqueID": "T1583.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1036.001", + "techniqueID": "T1072", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1201", - "score": 1, + "techniqueID": "T1210", + "score": 2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" }, { - "techniqueID": "T1187", + "techniqueID": "T1199", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { - "techniqueID": "T1567.002", - "score": 2, + "techniqueID": "T1069.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1564.005", - "score": 2, + "techniqueID": "T1097", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.004", - "score": 2, + "techniqueID": "T1090.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1098.002", - "score": 2, + "techniqueID": "T1584.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1037.001", - "score": 2, - "showSubtechniques": false + "techniqueID": "T1486", + "score": -1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" }, { - "techniqueID": "T1480.001", - "score": 2, + "techniqueID": "T1573", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + "techniqueID": "T1028", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1596.003", - "score": 2, + "techniqueID": "T1027.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1222.002", - "score": 2, + "techniqueID": "T1197", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1492", + "techniqueID": "T1585", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" }, { - "techniqueID": "T1213.002", - "score": 2, + "techniqueID": "T1500", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1109", - "score": 2, - "showSubtechniques": false + "techniqueID": "T1485", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" }, { - "techniqueID": "T1588.004", - "score": 2, + "techniqueID": "T1498", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1587.003", - "score": 2, + "techniqueID": "T1588.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1565.001", - "score": 2, + "techniqueID": "T1008", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + "techniqueID": "T1090.001", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1568.001", - "score": 2, + "techniqueID": "T1584.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1559.001", - "score": 2, + "techniqueID": "T1529", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1115", - "score": 2, + "techniqueID": "T1067", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.007", - "score": 2, + "techniqueID": "T1542.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1176", - "score": 2, + "techniqueID": "T1080", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.003", - "score": 2, + "techniqueID": "T1587.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1560.002", - "score": 2, + "techniqueID": "T1091", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1032", - "score": 2, + "techniqueID": "T1583.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1087.003", - "score": 2, + "techniqueID": "T1572", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.003", - "score": 2, + "techniqueID": "T1004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1562.002", - "score": 2, + "techniqueID": "T1071.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1145", - "score": 2, + "techniqueID": "T1021.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1552.004", - "score": 2, + "techniqueID": "T1547.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.004", - "score": 2, + "techniqueID": "T1550.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1134.002", - "score": 2, + "techniqueID": "T1188", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1125", - "score": 2, + "techniqueID": "T1074", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1542.002", - "score": 2, + "techniqueID": "T1583.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.003", + "techniqueID": "T1072", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1191", + "techniqueID": "T1210", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" }, { - "techniqueID": "T1055.002", + "techniqueID": "T1199", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { - "techniqueID": "T1059.004", - "score": 2, + "techniqueID": "T1069.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1208", - "score": 2, + "techniqueID": "T1097", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1036.001", - "score": 2, + "techniqueID": "T1090.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1201", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + "techniqueID": "T1584.006", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1187", - "score": 2, - "showSubtechniques": false + "techniqueID": "T1486", + "score": -1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" }, { - "techniqueID": "T1567.002", - "score": 2, + "techniqueID": "T1573", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1564.005", - "score": 2, + "techniqueID": "T1028", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.004", - "score": 2, + "techniqueID": "T1027.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1098.002", - "score": 2, + "techniqueID": "T1197", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1037.001", + "techniqueID": "T1585", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" }, { - "techniqueID": "T1480.001", - "score": 2, + "techniqueID": "T1500", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1558.003", - "score": 0, + "techniqueID": "T1485", + "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" }, { - "techniqueID": "T1596.003", - "score": 2, + "techniqueID": "T1498", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1222.002", - "score": 2, + "techniqueID": "T1588.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1492", - "score": 2, + "techniqueID": "T1008", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1213.002", - "score": 2, + "techniqueID": "T1053.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1109", - "score": 2, + "techniqueID": "T1090.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1588.004", - "score": 2, + "techniqueID": "T1584.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1587.003", - "score": 2, + "techniqueID": "T1529", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1565.001", - "score": 2, + "techniqueID": "T1067", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + "techniqueID": "T1080", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1568.001", - "score": 2, + "techniqueID": "T1587.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1559.001", - "score": 2, + "techniqueID": "T1091", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1115", - "score": 2, + "techniqueID": "T1583.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.007", - "score": 2, + "techniqueID": "T1572", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1176", - "score": 2, + "techniqueID": "T1004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.003", - "score": 2, + "techniqueID": "T1071.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1560.002", - "score": 2, + "techniqueID": "T1021.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1032", - "score": 2, + "techniqueID": "T1547.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1087.003", - "score": 2, + "techniqueID": "T1550.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.003", - "score": 2, + "techniqueID": "T1188", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1562.002", - "score": 2, + "techniqueID": "T1074", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1145", - "score": 2, + "techniqueID": "T1104", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1552.004", - "score": 2, + "techniqueID": "T1583.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.004", + "techniqueID": "T1072", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1134.002", + "techniqueID": "T1210", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" }, { - "techniqueID": "T1125", + "techniqueID": "T1199", "score": 2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1069.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1482", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": false }, { - "techniqueID": "T1542.002", - "score": 2, + "techniqueID": "T1090.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.003", - "score": 2, + "techniqueID": "T1584.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1191", - "score": 2, + "techniqueID": "T1486", + "score": -1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + }, + { + "techniqueID": "T1573", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1055.002", - "score": 2, + "techniqueID": "T1028", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1059.004", - "score": 2, + "techniqueID": "T1027.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1208", - "score": 2, + "techniqueID": "T1197", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1036.001", + "techniqueID": "T1585", "score": 2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1500", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1201", + "techniqueID": "T1485", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml" }, { - "techniqueID": "T1187", - "score": 2, + "techniqueID": "T1498", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1567.002", - "score": 2, + "techniqueID": "T1588.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1564.005", - "score": 2, + "techniqueID": "T1008", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.004", - "score": 2, + "techniqueID": "T1053.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1098.002", - "score": 2, + "techniqueID": "T1090.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1037.001", - "score": 2, + "techniqueID": "T1584.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1480.001", - "score": 2, + "techniqueID": "T1529", + "score": 3, "showSubtechniques": false }, - { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, { "techniqueID": "T1596.003", "score": 2, @@ -430586,9 +422798,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -430806,9 +423017,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -431026,9 +423236,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -431246,9 +423455,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -431466,9 +423674,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -431686,9 +423893,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -431906,9 +424112,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -432126,9 +424331,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -432346,9 +424550,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -432566,9 +424769,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -432786,9 +424988,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -433006,9 +425207,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -433226,9 +425426,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -433446,9 +425645,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -433666,9 +426083,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -433886,9 +426302,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -434106,9 +426521,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -434326,9 +426740,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -434546,9 +426959,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -434766,9 +427178,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -434986,9 +427397,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -435206,9 +427616,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -435426,9 +427835,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -435646,9 +428054,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -435866,9 +428273,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -436086,9 +428711,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -436306,9 +428930,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -436526,9 +429149,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -436746,9 +429368,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -436966,9 +429587,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -437186,9 +429806,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -437406,9 +430025,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -437626,9 +430244,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -437846,9 +430463,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -438066,9 +430682,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -438286,9 +430901,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -438506,9 +431339,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -438726,9 +431558,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -438946,9 +431777,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -439166,9 +431996,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -439386,9 +432215,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -439606,9 +432434,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -439826,9 +432653,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -440046,9 +432872,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -440266,9 +433091,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -440486,9 +433310,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -440706,9 +433529,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -440926,9 +433967,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -441146,9 +434186,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -441366,9 +434405,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -441586,9 +434624,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -441806,9 +434843,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -442026,9 +435062,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -442246,9 +435281,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -442466,9 +435500,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -442686,9 +435719,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -442906,9 +435938,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -443126,9 +436157,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -443346,9 +436595,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -443566,9 +436814,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -443786,9 +437033,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -444006,9 +437252,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -444226,9 +437471,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -444446,9 +437690,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -444666,9 +437909,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -444886,9 +438128,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -445106,9 +438347,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -445326,9 +438566,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -445546,9 +438785,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -445766,9 +439223,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -445986,9 +439442,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -446206,9 +439661,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -446426,9 +439880,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -446646,9 +440099,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -446866,9 +440318,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -447086,9 +440537,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -447306,9 +440756,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -447526,9 +440975,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -447746,9 +441194,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -447966,9 +441413,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -448186,9 +441851,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -448406,9 +442070,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -448626,9 +442289,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -448846,9 +442508,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -449066,9 +442727,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -449286,9 +442946,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -449506,9 +443165,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -449726,9 +443384,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -449946,9 +443603,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -450166,9 +443822,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -450386,9 +444041,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -450606,9 +444479,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -450826,9 +444698,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -451046,9 +444917,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -451266,9 +445136,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -451486,9 +445355,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -451706,9 +445574,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -451926,9 +445793,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -452146,9 +446012,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -452366,9 +446231,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -452586,9 +446450,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -452806,9 +446669,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -453026,9 +447107,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -453246,9 +447326,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -453466,9 +447545,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -453686,9 +447764,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -453906,9 +447983,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -454126,9 +448202,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -454346,9 +448421,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -454566,9 +448640,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -454786,9 +448859,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -455006,9 +449078,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -455226,9 +449297,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -455446,9 +449735,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -455666,9 +449954,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -455886,9 +450173,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -456106,9 +450392,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -456326,9 +450611,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -456546,9 +450830,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -456766,9 +451049,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -456986,9 +451268,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -457206,9 +451487,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -457426,9 +451706,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -457646,9 +451925,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -457866,9 +452363,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -458086,9 +452582,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -458306,9 +452801,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -458526,9 +453020,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -458746,9 +453239,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -458966,9 +453458,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -459186,9 +453677,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -459406,9 +453896,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -459626,9 +454115,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -459846,9 +454334,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -460066,9 +454553,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -460286,9 +454991,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -460506,9 +455210,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -460726,9 +455429,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -460946,9 +455648,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -461166,9 +455867,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -461386,9 +456086,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -461606,9 +456305,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -461826,9 +456524,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -462046,9 +456743,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -462266,9 +456962,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -462486,9 +457181,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -462706,9 +457619,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -462926,9 +457838,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -463146,9 +458057,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -463366,9 +458276,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -463586,9 +458495,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -463806,9 +458714,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -464026,9 +458933,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -464246,9 +459152,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -464466,9 +459371,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -464686,9 +459590,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -464906,9 +459809,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -465126,9 +460247,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -465346,9 +460466,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -465566,9 +460685,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -465786,9 +460904,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -466006,9 +461123,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -466226,9 +461342,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -466446,9 +461561,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -466666,9 +461780,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -466886,9 +461999,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -467106,9 +462218,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -467326,9 +462437,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -467546,9 +462875,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -467766,9 +463094,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -467986,9 +463313,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -468206,9 +463532,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -468426,9 +463751,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -468646,9 +463970,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -468866,9 +464189,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -469086,9 +464408,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -469306,9 +464627,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -469526,9 +464846,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -469746,9 +465065,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -469966,9 +465503,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -470186,9 +465722,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -470406,9 +465941,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -470626,9 +466160,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -470846,9 +466379,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -471066,9 +466598,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -471286,9 +466817,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -471506,9 +467036,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -471726,9 +467255,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -471946,9 +467474,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -472166,9 +467693,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -472386,9 +468131,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -472606,9 +468350,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -472826,9 +468569,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -473046,9 +468788,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -473266,9 +469007,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -473486,9 +469226,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -473706,9 +469445,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -473926,9 +469664,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -474146,9 +469883,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -474366,9 +470102,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -474586,9 +470321,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -474806,9 +470759,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -475026,9 +470978,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -475246,9 +471197,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -475466,9 +471416,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -475686,9 +471635,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -475906,9 +471854,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -476126,9 +472073,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -476346,9 +472292,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -476566,9 +472511,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -476786,9 +472730,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -477006,9 +472949,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -477226,9 +473387,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -477446,9 +473606,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -477666,9 +473825,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -477886,9 +474044,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -478106,9 +474263,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -478326,9 +474482,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -478546,9 +474701,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -478766,9 +474920,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -478986,9 +475139,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -479206,9 +475358,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -479426,9 +475577,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -479646,9 +476015,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -479866,9 +476234,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -480086,9 +476453,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -480306,9 +476672,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -480526,9 +476891,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -480746,9 +477110,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -480966,9 +477329,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -481186,9 +477548,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -481406,9 +477767,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -481626,9 +477986,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -481846,9 +478205,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -482066,9 +478643,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -482286,9 +478862,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -482506,9 +479081,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -482726,9 +479300,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -482946,9 +479519,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -483166,9 +479738,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -483386,9 +479957,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -483606,9 +480176,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -483826,9 +480395,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -484046,9 +480614,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -484266,9 +480833,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -484486,9 +481271,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -484706,9 +481490,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -484926,9 +481709,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -485146,9 +481928,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -485366,9 +482147,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -485586,9 +482366,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -485806,9 +482585,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -486026,9 +482804,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -486246,9 +483023,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -486466,9 +483242,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -486686,9 +483461,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -486906,9 +483899,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -487126,9 +484118,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -487346,9 +484337,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -487566,9 +484556,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -487786,9 +484775,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -488006,9 +484994,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -488226,9 +485213,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -488446,9 +485432,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -488666,9 +485651,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -488886,9 +485870,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -489106,9 +486089,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -489326,9 +486527,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -489546,9 +486746,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -489766,9 +486965,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -489986,9 +487184,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -490206,9 +487403,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -490426,9 +487622,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -490646,9 +487841,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -490866,9 +488060,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -491086,9 +488279,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -491306,9 +488498,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -491526,9 +488717,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -491746,9 +489155,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -491966,9 +489374,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -492186,9 +489593,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -492406,9 +489812,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -492626,9 +490031,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -492846,9 +490250,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -493066,9 +490469,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -493286,9 +490688,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -493506,9 +490907,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -493726,9 +491126,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -493946,9 +491345,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -494166,9 +491783,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -494386,9 +492002,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -494606,9 +492221,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -494826,9 +492440,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -495046,9 +492659,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -495266,9 +492878,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -495486,9 +493097,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -495706,9 +493316,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -495926,9 +493535,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -496146,9 +493754,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -496366,9 +493973,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -496586,9 +494411,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -496806,9 +494630,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -497026,9 +494849,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -497246,9 +495068,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -497466,9 +495287,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -497686,9 +495506,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -497906,9 +495725,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -498126,9 +495944,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -498346,9 +496163,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -498566,9 +496382,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -498786,9 +496601,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -499006,9 +497039,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -499226,9 +497258,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -499446,9 +497477,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -499666,9 +497696,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -499886,9 +497915,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -500106,9 +498134,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -500326,9 +498353,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -500546,9 +498572,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -500766,9 +498791,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -500986,9 +499010,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -501206,9 +499229,227 @@ }, { "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -501426,9 +499667,8 @@ }, { "techniqueID": "T1114.001", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/email_files_written_outside_of_the_outlook_directory.yml" + "score": 2, + "showSubtechniques": false }, { "techniqueID": "T1489", @@ -501611,9 +499851,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -501989,9 +500228,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -502010,9 +500248,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -502046,9 +500283,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -502102,9 +500339,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -502480,9 +500716,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -502501,9 +500736,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -502537,9 +500771,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -502593,9 +500827,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -502971,9 +501204,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -502992,9 +501224,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -503028,9 +501259,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -503084,9 +501315,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -503462,9 +501692,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -503483,9 +501712,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -503519,9 +501747,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -503575,9 +501803,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -503953,9 +502180,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -503974,9 +502200,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -504010,9 +502235,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -504066,9 +502291,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -504444,9 +502668,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -504465,9 +502688,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -504501,9 +502723,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -504557,9 +502779,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -504935,9 +503156,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -504956,9 +503176,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -504992,9 +503211,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -505048,9 +503267,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -505426,9 +503644,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -505447,9 +503664,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -505483,9 +503699,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -505539,9 +503755,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -505917,9 +504132,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -505938,9 +504152,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -505974,9 +504187,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -506030,9 +504243,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -506408,9 +504620,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -506429,9 +504640,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -506465,9 +504675,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -506521,9 +504731,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -506899,9 +505108,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -506920,9 +505128,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -506956,9 +505163,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -507012,9 +505219,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -507390,9 +505596,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -507411,9 +505616,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -507447,9 +505651,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -507503,9 +505707,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -507881,9 +506084,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -507902,9 +506104,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -507938,9 +506139,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -507994,9 +506195,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -508372,9 +506572,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -508393,9 +506592,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -508429,9 +506627,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -508485,9 +506683,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -508863,9 +507060,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -508884,9 +507080,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -508920,9 +507115,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -508976,9 +507171,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -509354,9 +507548,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -509375,9 +507568,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -509411,9 +507603,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -509467,9 +507659,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -509845,9 +508036,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -509866,9 +508056,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -509902,9 +508091,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -509958,9 +508147,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -510336,9 +508524,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -510357,9 +508544,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -510393,9 +508579,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -510449,9 +508635,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -510827,9 +509012,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -510848,9 +509032,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -510884,9 +509067,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -510940,9 +509123,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -511318,9 +509500,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -511339,9 +509520,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -511375,9 +509555,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -511431,9 +509611,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -511809,9 +509988,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -511830,9 +510008,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -511866,9 +510043,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -511922,9 +510099,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -512300,9 +510476,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -512321,9 +510496,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -512357,9 +510531,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -512413,9 +510587,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -512791,9 +510964,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -512812,9 +510984,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -512848,9 +511019,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -512904,9 +511075,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -513282,9 +511452,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -513303,9 +511472,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -513339,9 +511507,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -513395,9 +511563,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -513773,9 +511940,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -513794,9 +511960,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -513830,9 +511995,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -513886,9 +512051,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -514264,9 +512428,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -514285,9 +512448,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -514321,9 +512483,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -514377,9 +512539,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -514755,9 +512916,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -514776,9 +512936,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -514812,9 +512971,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -514868,9 +513027,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -515246,9 +513404,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -515267,9 +513424,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -515303,9 +513459,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -515359,9 +513515,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -515737,9 +513892,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -515758,9 +513912,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -515794,9 +513947,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -515850,9 +514003,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -516228,9 +514380,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -516249,9 +514400,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -516285,9 +514435,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -516341,9 +514491,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -516719,9 +514868,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -516740,9 +514888,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -516776,9 +514923,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -516832,9 +514979,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -517210,9 +515356,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -517231,9 +515376,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -517267,9 +515411,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -517323,9 +515467,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -517701,9 +515844,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -517722,9 +515864,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -517758,9 +515899,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -517814,9 +515955,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -518192,9 +516332,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -518213,9 +516352,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -518249,9 +516387,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -518305,9 +516443,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -518683,9 +516820,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -518704,9 +516840,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -518740,9 +516875,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -518796,9 +516931,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -519174,9 +517308,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -519195,9 +517328,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -519231,9 +517363,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -519287,9 +517419,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -519665,9 +517796,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -519686,9 +517816,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -519722,9 +517851,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -519778,9 +517907,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -520156,9 +518284,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -520177,9 +518304,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -520213,9 +518339,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -520269,9 +518395,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -520647,9 +518772,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -520668,9 +518792,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -520704,9 +518827,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -520760,9 +518883,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -521138,9 +519260,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -521159,9 +519280,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -521195,9 +519315,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -521251,9 +519371,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -521629,9 +519748,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -521650,9 +519768,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -521686,9 +519803,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -521742,9 +519859,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -522120,9 +520236,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -522141,9 +520256,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -522177,9 +520291,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -522233,9 +520347,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -522611,9 +520724,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -522632,9 +520744,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -522668,9 +520779,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -522724,9 +520835,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -523102,9 +521212,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -523123,9 +521232,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -523159,9 +521267,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -523215,9 +521323,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -523593,9 +521700,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -523614,9 +521720,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -523650,9 +521755,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -523706,9 +521811,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -524084,9 +522188,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -524105,9 +522208,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -524141,9 +522243,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -524197,9 +522299,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -524575,9 +522676,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -524596,9 +522696,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -524632,9 +522731,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -524688,9 +522787,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -525066,9 +523164,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -525087,9 +523184,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -525123,9 +523219,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -525179,9 +523275,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -525557,9 +523652,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -525578,9 +523672,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -525614,9 +523707,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -525670,9 +523763,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -526048,9 +524140,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -526069,9 +524160,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -526105,9 +524195,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -526161,9 +524251,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -526539,9 +524628,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -526560,9 +524648,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -526596,9 +524683,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -526652,9 +524739,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -527030,9 +525116,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -527051,9 +525136,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -527087,9 +525171,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -527143,9 +525227,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -527521,9 +525604,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -527542,9 +525624,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -527578,9 +525659,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -527634,9 +525715,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -528012,9 +526092,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -528033,9 +526112,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -528069,9 +526147,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -528125,9 +526203,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -528503,9 +526580,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -528524,9 +526600,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -528560,9 +526635,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -528616,9 +526691,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -528994,9 +527068,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -529015,9 +527088,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -529051,9 +527123,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -529107,9 +527179,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -529485,9 +527556,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -529506,9 +527576,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -529542,9 +527611,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -529598,9 +527667,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -529976,9 +528044,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -529997,9 +528064,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -530033,9 +528099,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -530089,9 +528155,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -530467,9 +528532,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -530488,9 +528552,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -530524,9 +528587,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -530580,9 +528643,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -530958,9 +529020,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -530979,9 +529040,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -531015,9 +529075,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -531071,9 +529131,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -531449,9 +529508,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -531470,9 +529528,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -531506,9 +529563,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -531562,9 +529619,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -531940,9 +529996,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -531961,9 +530016,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -531997,9 +530051,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -532053,9 +530107,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -532431,9 +530484,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -532452,9 +530504,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -532488,9 +530539,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -532544,9 +530595,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -532922,9 +530972,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -532943,9 +530992,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -532979,9 +531027,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -533035,9 +531083,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -533413,9 +531460,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -533434,9 +531480,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -533470,9 +531515,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -533526,9 +531571,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -533904,9 +531948,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -533925,9 +531968,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -533961,9 +532003,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -534017,9 +532059,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -534395,9 +532436,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -534416,9 +532456,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -534452,9 +532491,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -534508,9 +532547,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -534886,9 +532924,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -534907,9 +532944,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -534943,9 +532979,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -534999,9 +533035,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -535377,9 +533412,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -535398,9 +533432,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -535434,9 +533467,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -535490,9 +533523,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -535868,9 +533900,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -535889,9 +533920,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -535925,9 +533955,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -535981,9 +534011,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -536359,9 +534388,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -536380,9 +534408,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -536416,9 +534443,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -536472,9 +534499,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -536850,9 +534876,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -536871,9 +534896,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -536907,9 +534931,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -536963,9 +534987,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -537341,9 +535364,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -537362,9 +535384,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -537398,9 +535419,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -537454,9 +535475,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -537832,9 +535852,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -537853,9 +535872,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -537889,9 +535907,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -537945,9 +535963,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -538323,9 +536340,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -538344,9 +536360,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -538380,9 +536395,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -538436,9 +536451,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -538814,9 +536828,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -538835,9 +536848,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -538871,9 +536883,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -538927,9 +536939,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -539305,9 +537316,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -539326,9 +537336,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -539362,9 +537371,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -539418,9 +537427,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -539796,9 +537804,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -539817,9 +537824,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -539853,9 +537859,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -539909,9 +537915,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -540287,9 +538292,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -540308,9 +538312,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -540344,9 +538347,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -540400,9 +538403,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -540778,9 +538780,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -540799,9 +538800,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -540835,9 +538835,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -540891,9 +538891,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -541269,9 +539268,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -541290,9 +539288,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -541326,9 +539323,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -541382,9 +539379,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -541760,9 +539756,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -541781,9 +539776,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -541817,9 +539811,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -541873,9 +539867,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -542251,9 +540244,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -542272,9 +540264,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -542308,9 +540299,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -542364,9 +540355,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -542742,9 +540732,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -542763,9 +540752,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -542799,9 +540787,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -542855,9 +540843,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -543233,9 +541220,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -543254,9 +541240,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -543290,9 +541275,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -543346,9 +541331,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -543724,9 +541708,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -543745,9 +541728,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -543781,9 +541763,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -543837,9 +541819,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -544215,9 +542196,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -544236,9 +542216,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -544272,9 +542251,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -544328,9 +542307,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -544706,9 +542684,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -544727,9 +542704,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -544763,9 +542739,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -544819,9 +542795,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -545197,9 +543172,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -545218,9 +543192,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -545254,9 +543227,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -545310,9 +543283,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -545688,9 +543660,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -545709,9 +543680,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -545745,9 +543715,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -545801,9 +543771,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -546179,9 +544148,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -546200,9 +544168,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -546236,9 +544203,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -546292,9 +544259,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -546670,9 +544636,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -546691,9 +544656,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -546727,9 +544691,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -546783,9 +544747,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -547161,9 +545124,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -547182,9 +545144,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -547218,9 +545179,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -547274,9 +545235,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -547652,9 +545612,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -547673,9 +545632,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -547709,9 +545667,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -547765,9 +545723,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -548143,9 +546100,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -548164,9 +546120,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -548200,9 +546155,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -548256,9 +546211,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -548634,9 +546588,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -548655,9 +546608,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -548691,9 +546643,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -548747,9 +546699,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -549125,9 +547076,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -549146,9 +547096,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -549182,9 +547131,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -549238,9 +547187,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -549616,9 +547564,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -549637,9 +547584,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -549673,9 +547619,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -549729,9 +547675,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -550107,9 +548052,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -550128,9 +548072,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -550164,9 +548107,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -550220,9 +548163,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -550598,9 +548540,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -550619,9 +548560,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -550655,9 +548595,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -550711,9 +548651,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -551089,9 +549028,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -551110,9 +549048,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -551146,9 +549083,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -551202,9 +549139,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -551580,9 +549516,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -551601,9 +549536,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -551637,9 +549571,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -551693,9 +549627,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -552071,9 +550004,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -552092,9 +550024,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -552128,9 +550059,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -552184,9 +550115,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -552562,9 +550492,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -552583,9 +550512,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -552619,9 +550547,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -552675,9 +550603,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -553053,9 +550980,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -553074,9 +551000,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -553110,9 +551035,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -553166,9 +551091,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -553544,9 +551468,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -553565,9 +551488,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -553601,9 +551523,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -553657,9 +551579,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -554035,9 +551956,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -554056,9 +551976,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -554092,9 +552011,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -554148,9 +552067,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -554526,9 +552444,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -554547,9 +552464,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -554583,9 +552499,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -554639,9 +552555,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -555017,9 +552932,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -555038,9 +552952,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -555074,9 +552987,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -555130,9 +553043,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -555508,9 +553420,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -555529,9 +553440,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -555565,9 +553475,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -555621,9 +553531,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -555999,9 +553908,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -556020,9 +553928,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -556056,9 +553963,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -556112,9 +554019,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -556490,9 +554396,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -556511,9 +554416,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -556547,9 +554451,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -556603,9 +554507,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -556981,9 +554884,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -557002,9 +554904,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -557038,9 +554939,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -557094,9 +554995,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -557472,9 +555372,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -557493,9 +555392,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -557529,9 +555427,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -557585,9 +555483,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -557963,9 +555860,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -557984,9 +555880,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -558020,9 +555915,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -558076,9 +555971,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -558454,9 +556348,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -558475,9 +556368,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -558511,9 +556403,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -558567,9 +556459,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -558945,9 +556836,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -558966,9 +556856,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -559002,9 +556891,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -559058,9 +556947,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -559436,9 +557324,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -559457,9 +557344,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -559493,9 +557379,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -559549,9 +557435,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -559927,9 +557812,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -559948,9 +557832,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -559984,9 +557867,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -560040,9 +557923,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -560418,9 +558300,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -560439,9 +558320,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -560475,9 +558355,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -560531,9 +558411,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -560909,9 +558788,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -560930,9 +558808,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -560966,9 +558843,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -561022,9 +558899,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -561400,9 +559276,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -561421,9 +559296,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -561457,9 +559331,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -561513,9 +559387,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -561891,9 +559764,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -561912,9 +559784,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -561948,9 +559819,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -562004,9 +559875,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -562382,9 +560252,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -562403,9 +560272,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -562439,9 +560307,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -562495,9 +560363,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -562873,9 +560740,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -562894,9 +560760,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -562930,9 +560795,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -562986,9 +560851,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -563364,9 +561228,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -563385,9 +561248,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -563421,9 +561283,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -563477,9 +561339,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -563855,9 +561716,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -563876,9 +561736,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -563912,9 +561771,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -563968,9 +561827,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -564346,9 +562204,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -564367,9 +562224,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -564403,9 +562259,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -564459,9 +562315,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -564837,9 +562692,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -564858,9 +562712,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -564894,9 +562747,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -564950,9 +562803,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -565328,9 +563180,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -565349,9 +563200,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -565385,9 +563235,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -565441,9 +563291,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -565819,9 +563668,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -565840,9 +563688,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -565876,9 +563723,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -565932,9 +563779,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -566310,9 +564156,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -566331,9 +564176,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -566367,9 +564211,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -566423,9 +564267,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -566801,9 +564644,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -566822,9 +564664,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -566858,9 +564699,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -566914,9 +564755,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -567292,9 +565132,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -567313,9 +565152,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -567349,9 +565187,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -567405,9 +565243,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -567783,9 +565620,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -567804,9 +565640,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -567840,9 +565675,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -567896,9 +565731,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -568274,9 +566108,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -568295,9 +566128,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -568331,9 +566163,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -568387,9 +566219,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -568765,9 +566596,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -568786,9 +566616,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -568822,9 +566651,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -568878,9 +566707,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -569256,9 +567084,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -569277,9 +567104,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -569313,9 +567139,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -569369,9 +567195,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -569747,9 +567572,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -569768,9 +567592,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -569804,9 +567627,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -569860,9 +567683,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -570238,9 +568060,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -570259,9 +568080,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -570295,9 +568115,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -570351,9 +568171,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -570729,9 +568548,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -570750,9 +568568,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -570786,9 +568603,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -570842,9 +568659,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -571220,9 +569036,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -571241,9 +569056,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -571277,9 +569091,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -571333,9 +569147,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -571711,9 +569524,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -571732,9 +569544,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -571768,9 +569579,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -571824,9 +569635,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -572202,9 +570012,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -572223,9 +570032,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -572259,9 +570067,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -572315,9 +570123,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -572693,9 +570500,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -572714,9 +570520,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -572750,9 +570555,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -572806,9 +570611,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -573184,9 +570988,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -573205,9 +571008,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -573241,9 +571043,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -573297,9 +571099,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -573675,9 +571476,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -573696,9 +571496,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -573732,9 +571531,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -573788,9 +571587,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -574166,9 +571964,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -574187,9 +571984,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -574223,9 +572019,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -574279,9 +572075,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -574657,9 +572452,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -574678,9 +572472,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -574714,9 +572507,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -574770,9 +572563,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -575148,9 +572940,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -575169,9 +572960,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -575205,9 +572995,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -575261,9 +573051,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -575639,9 +573428,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -575660,9 +573448,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -575696,9 +573483,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -575752,9 +573539,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -576130,9 +573916,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -576151,9 +573936,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -576187,9 +573971,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -576243,9 +574027,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -576621,9 +574404,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -576642,9 +574424,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -576678,9 +574459,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -576734,9 +574515,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -577112,9 +574892,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -577133,9 +574912,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -577169,9 +574947,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -577225,9 +575003,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -577603,9 +575380,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -577624,9 +575400,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -577660,9 +575435,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -577716,9 +575491,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -578094,9 +575868,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -578115,9 +575888,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -578151,9 +575923,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -578207,9 +575979,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -578585,9 +576356,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -578606,9 +576376,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -578642,9 +576411,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -578698,9 +576467,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -579076,9 +576844,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -579097,9 +576864,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -579133,9 +576899,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -579189,9 +576955,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -579567,9 +577332,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -579588,9 +577352,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -579624,9 +577387,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -579680,9 +577443,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -580058,9 +577820,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -580079,9 +577840,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -580115,9 +577875,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -580171,9 +577931,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -580549,9 +578308,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -580570,9 +578328,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -580606,9 +578363,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -580662,9 +578419,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -581040,9 +578796,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -581061,9 +578816,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -581097,9 +578851,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -581153,9 +578907,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -581531,9 +579284,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -581552,9 +579304,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -581588,9 +579339,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -581644,9 +579395,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -582022,9 +579772,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -582043,9 +579792,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -582079,9 +579827,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -582135,9 +579883,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -582513,9 +580260,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -582534,9 +580280,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -582570,9 +580315,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -582626,9 +580371,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -583004,9 +580748,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -583025,9 +580768,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -583061,9 +580803,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -583117,9 +580859,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -583495,9 +581236,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -583516,9 +581256,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -583552,9 +581291,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -583608,9 +581347,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -583986,9 +581724,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -584007,9 +581744,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -584043,9 +581779,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -584099,9 +581835,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -584477,9 +582212,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -584498,9 +582232,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -584534,9 +582267,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -584590,9 +582323,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -584968,9 +582700,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -584989,9 +582720,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -585025,9 +582755,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -585081,9 +582811,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -585459,9 +583188,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -585480,9 +583208,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -585516,9 +583243,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -585572,9 +583299,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -585950,9 +583676,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -585971,9 +583696,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -586007,9 +583731,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -586063,9 +583787,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -586441,9 +584164,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -586462,9 +584184,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -586498,9 +584219,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -586554,9 +584275,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -586932,9 +584652,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -586953,9 +584672,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -586989,9 +584707,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -587045,9 +584763,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -587423,9 +585140,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -587444,9 +585160,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -587480,9 +585195,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -587536,9 +585251,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -587914,9 +585628,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -587935,9 +585648,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -587971,9 +585683,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -588027,9 +585739,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -588405,9 +586116,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -588426,9 +586136,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -588462,9 +586171,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -588518,9 +586227,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -588896,9 +586604,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -588917,9 +586624,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -588953,9 +586659,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -589009,9 +586715,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -589387,9 +587092,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -589408,9 +587112,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -589444,9 +587147,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -589500,9 +587203,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -589878,9 +587580,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -589899,9 +587600,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -589935,9 +587635,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -589991,9 +587691,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -590369,9 +588068,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -590390,9 +588088,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -590426,9 +588123,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -590482,9 +588179,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -590860,9 +588556,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -590881,9 +588576,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -590917,9 +588611,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -590973,9 +588667,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -591351,9 +589044,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -591372,9 +589064,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -591408,9 +589099,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -591464,9 +589155,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -591842,9 +589532,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -591863,9 +589552,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -591899,9 +589587,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -591955,9 +589643,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -592333,9 +590020,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -592354,9 +590040,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -592390,9 +590075,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -592446,9 +590131,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -592824,9 +590508,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -592845,9 +590528,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -592881,9 +590563,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -592937,9 +590619,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -593315,9 +590996,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -593336,9 +591016,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -593372,9 +591051,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -593428,9 +591107,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -593806,9 +591484,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -593827,9 +591504,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -593863,9 +591539,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -593919,9 +591595,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -594297,9 +591972,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -594318,9 +591992,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -594354,9 +592027,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -594410,9 +592083,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -594788,9 +592460,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -594809,9 +592480,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -594845,9 +592515,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -594901,9 +592571,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -595279,9 +592948,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -595300,9 +592968,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -595336,9 +593003,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -595392,9 +593059,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -595770,9 +593436,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -595791,9 +593456,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -595827,9 +593491,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -595883,9 +593547,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -596261,9 +593924,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -596282,9 +593944,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -596318,9 +593979,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -596374,9 +594035,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -596752,9 +594412,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -596773,9 +594432,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -596809,9 +594467,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -596865,9 +594523,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -597243,9 +594900,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -597264,9 +594920,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -597300,9 +594955,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -597356,9 +595011,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -597734,9 +595388,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -597755,9 +595408,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -597791,9 +595443,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -597847,9 +595499,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -598225,9 +595876,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -598246,9 +595896,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -598282,9 +595931,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -598338,9 +595987,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -598716,9 +596364,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -598737,9 +596384,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -598773,9 +596419,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -598829,9 +596475,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -599207,9 +596852,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -599228,9 +596872,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -599264,9 +596907,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -599320,9 +596963,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -599698,9 +597340,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -599719,9 +597360,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -599755,9 +597395,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -599811,9 +597451,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -600189,9 +597828,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -600210,9 +597848,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -600246,9 +597883,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -600302,9 +597939,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -600680,9 +598316,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -600701,9 +598336,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -600737,9 +598371,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -600793,9 +598427,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -601171,9 +598804,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -601192,9 +598824,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -601228,9 +598859,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -601284,9 +598915,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -601662,9 +599292,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -601683,9 +599312,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -601719,9 +599347,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -601775,9 +599403,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -602153,9 +599780,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -602174,9 +599800,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -602210,9 +599835,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -602266,9 +599891,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -602644,9 +600268,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -602665,9 +600288,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -602701,9 +600323,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -602757,9 +600379,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -603135,9 +600756,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -603156,9 +600776,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -603192,9 +600811,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -603248,9 +600867,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -603626,9 +601244,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -603647,9 +601264,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -603683,9 +601299,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -603739,9 +601355,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -604117,9 +601732,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -604138,9 +601752,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -604174,9 +601787,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -604230,9 +601843,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -604608,9 +602220,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -604629,9 +602240,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -604665,9 +602275,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -604721,9 +602331,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -605099,9 +602708,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -605120,9 +602728,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -605156,9 +602763,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -605212,9 +602819,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -605590,9 +603196,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -605611,9 +603216,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -605647,9 +603251,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -605703,9 +603307,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -606081,9 +603684,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -606102,9 +603704,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -606138,9 +603739,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -606194,9 +603795,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -606572,9 +604172,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -606593,9 +604192,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -606629,9 +604227,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -606685,9 +604283,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -607063,9 +604660,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -607084,9 +604680,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -607120,9 +604715,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -607176,9 +604771,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -607554,9 +605148,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -607575,9 +605168,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -607611,9 +605203,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -607667,9 +605259,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -608045,9 +605636,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -608066,9 +605656,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -608102,9 +605691,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -608158,9 +605747,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -608536,9 +606124,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -608557,9 +606144,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -608593,9 +606179,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -608649,9 +606235,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -609027,9 +606612,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -609048,9 +606632,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -609084,9 +606667,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -609140,9 +606723,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -609518,9 +607100,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -609539,9 +607120,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -609575,9 +607155,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -609631,9 +607211,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -610009,9 +607588,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -610030,9 +607608,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -610066,9 +607643,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -610122,9 +607699,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -610500,9 +608076,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -610521,9 +608096,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -610557,9 +608131,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -610613,9 +608187,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -610991,9 +608564,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -611012,9 +608584,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -611048,9 +608619,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -611104,9 +608675,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -611482,9 +609052,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -611503,9 +609072,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -611539,9 +609107,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -611595,9 +609163,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -611973,9 +609540,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -611994,9 +609560,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -612030,9 +609595,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -612086,9 +609651,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -612464,9 +610028,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -612485,9 +610048,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -612521,9 +610083,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -612577,9 +610139,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -612955,9 +610516,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -612976,9 +610536,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -613012,9 +610571,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -613068,9 +610627,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -613446,9 +611004,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -613467,9 +611024,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -613503,9 +611059,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -613559,9 +611115,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -613937,9 +611492,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -613958,9 +611512,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -613994,9 +611547,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -614050,9 +611603,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -614428,9 +611980,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -614449,9 +612000,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -614485,9 +612035,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -614541,9 +612091,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -614919,9 +612468,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -614940,9 +612488,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -614976,9 +612523,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -615032,9 +612579,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -615410,9 +612956,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -615431,9 +612976,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -615467,9 +613011,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -615523,9 +613067,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -615901,9 +613444,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -615922,9 +613464,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -615958,9 +613499,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -616014,9 +613555,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -616392,9 +613932,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -616413,9 +613952,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -616449,9 +613987,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -616505,9 +614043,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -616883,9 +614420,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -616904,9 +614440,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -616940,9 +614475,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -616996,9 +614531,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -617374,9 +614908,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -617395,9 +614928,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -617431,9 +614963,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -617487,9 +615019,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -617865,9 +615396,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -617886,9 +615416,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -617922,9 +615451,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -617978,9 +615507,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -618356,9 +615884,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -618377,9 +615904,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -618413,9 +615939,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -618469,9 +615995,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -618847,9 +616372,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -618868,9 +616392,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -618904,9 +616427,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -618960,9 +616483,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -619338,9 +616860,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -619359,9 +616880,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -619395,9 +616915,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -619451,9 +616971,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -619829,9 +617348,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -619850,9 +617368,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -619886,9 +617403,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -619942,9 +617459,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -620320,9 +617836,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -620341,9 +617856,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -620377,9 +617891,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -620433,9 +617947,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -620811,9 +618324,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -620832,9 +618344,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -620868,9 +618379,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -620924,9 +618435,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -621302,9 +618812,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -621323,9 +618832,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -621359,9 +618867,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -621415,9 +618923,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -621793,9 +619300,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -621814,9 +619320,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -621850,9 +619355,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -621906,9 +619411,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -622284,9 +619788,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -622305,9 +619808,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -622341,9 +619843,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -622397,9 +619899,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -622775,9 +620276,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -622796,9 +620296,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -622832,9 +620331,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -622888,9 +620387,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -623266,9 +620764,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -623287,9 +620784,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -623323,9 +620819,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -623379,9 +620875,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -623757,9 +621252,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -623778,9 +621272,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -623814,9 +621307,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -623870,9 +621363,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -624248,9 +621740,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -624269,9 +621760,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -624305,9 +621795,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -624361,9 +621851,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -624739,9 +622228,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -624760,9 +622248,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -624796,9 +622283,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -624852,9 +622339,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -625230,9 +622716,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -625251,9 +622736,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -625287,9 +622771,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -625343,9 +622827,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -625721,9 +623204,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -625742,9 +623224,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -625778,9 +623259,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -625834,9 +623315,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -626212,9 +623692,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -626233,9 +623712,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -626269,9 +623747,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -626325,9 +623803,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -626703,9 +624180,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -626724,9 +624200,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -626760,9 +624235,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -626816,9 +624291,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -627194,9 +624668,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -627215,9 +624688,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -627251,9 +624723,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -627307,9 +624779,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -627685,9 +625156,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -627706,9 +625176,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -627742,9 +625211,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -627798,9 +625267,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -628176,9 +625644,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -628197,9 +625664,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -628233,9 +625699,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -628289,9 +625755,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -628667,9 +626132,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -628688,9 +626152,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -628724,9 +626187,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -628780,9 +626243,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -629158,9 +626620,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -629179,9 +626640,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -629215,9 +626675,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -629271,9 +626731,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -629649,9 +627108,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -629670,9 +627128,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -629706,9 +627163,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -629762,9 +627219,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -630140,9 +627596,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -630161,9 +627616,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -630197,9 +627651,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -630253,9 +627707,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -630631,9 +628084,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -630652,9 +628104,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -630688,9 +628139,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -630744,9 +628195,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -631122,9 +628572,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -631143,9 +628592,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -631179,9 +628627,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -631235,9 +628683,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -631613,9 +629060,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -631634,9 +629080,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -631670,9 +629115,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -631726,9 +629171,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -632104,9 +629548,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -632125,9 +629568,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -632161,9 +629603,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -632217,9 +629659,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -632595,9 +630036,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -632616,9 +630056,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -632652,9 +630091,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -632708,9 +630147,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -633086,9 +630524,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -633107,9 +630544,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -633143,9 +630579,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -633199,9 +630635,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -633577,9 +631012,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -633598,9 +631032,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -633634,9 +631067,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -633690,9 +631123,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -634068,9 +631500,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -634089,9 +631520,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -634125,9 +631555,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -634181,9 +631611,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -634559,9 +631988,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -634580,9 +632008,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -634616,9 +632043,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -634672,9 +632099,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -635050,9 +632476,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -635071,9 +632496,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -635107,9 +632531,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -635163,9 +632587,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -635541,9 +632964,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -635562,9 +632984,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -635598,9 +633019,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -635654,9 +633075,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -636032,9 +633452,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -636053,9 +633472,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -636089,9 +633507,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -636145,9 +633563,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -636523,9 +633940,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -636544,9 +633960,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -636580,9 +633995,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -636636,9 +634051,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -637014,9 +634428,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -637035,9 +634448,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -637071,9 +634483,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -637127,9 +634539,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -637505,9 +634916,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -637526,9 +634936,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -637562,9 +634971,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -637618,9 +635027,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -637996,9 +635404,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -638017,9 +635424,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -638053,9 +635459,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -638109,9 +635515,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -638487,9 +635892,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -638508,9 +635912,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -638544,9 +635947,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -638600,9 +636003,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -638978,9 +636380,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -638999,9 +636400,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -639035,9 +636435,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -639091,9 +636491,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -639469,9 +636868,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -639490,9 +636888,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -639526,9 +636923,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -639582,9 +636979,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -639960,9 +637356,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -639981,9 +637376,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -640017,9 +637411,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -640073,9 +637467,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -640451,9 +637844,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -640472,9 +637864,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -640508,9 +637899,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -640564,9 +637955,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -640942,9 +638332,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -640963,9 +638352,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -640999,9 +638387,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -641055,9 +638443,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -641433,9 +638820,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -641454,9 +638840,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -641490,9 +638875,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -641546,9 +638931,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -641924,9 +639308,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -641945,9 +639328,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -641981,9 +639363,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -642037,9 +639419,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -642415,9 +639796,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -642436,9 +639816,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -642472,9 +639851,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -642528,9 +639907,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -642906,9 +640284,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -642927,9 +640304,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -642963,9 +640339,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -643019,9 +640395,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -643397,9 +640772,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -643418,9 +640792,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -643454,9 +640827,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -643510,9 +640883,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -643888,9 +641260,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -643909,9 +641280,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -643945,9 +641315,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -644001,9 +641371,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -644379,9 +641748,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -644400,9 +641768,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -644436,9 +641803,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -644492,9 +641859,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -644870,9 +642236,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -644891,9 +642256,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -644927,9 +642291,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -644983,9 +642347,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -645361,9 +642724,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -645382,9 +642744,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -645418,9 +642779,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -645474,9 +642835,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -645852,9 +643212,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -645873,9 +643232,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -645909,9 +643267,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -645965,9 +643323,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -646343,9 +643700,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -646364,9 +643720,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -646400,9 +643755,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -646456,9 +643811,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -646834,9 +644188,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -646855,9 +644208,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -646891,9 +644243,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -646947,9 +644299,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -647325,9 +644676,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -647346,9 +644696,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -647382,9 +644731,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -647438,9 +644787,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -647816,9 +645164,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -647837,9 +645184,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -647873,9 +645219,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -647929,9 +645275,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -648307,9 +645652,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -648328,9 +645672,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -648364,9 +645707,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -648420,9 +645763,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -648798,9 +646140,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -648819,9 +646160,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -648855,9 +646195,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -648911,9 +646251,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -649289,9 +646628,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -649310,9 +646648,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -649346,9 +646683,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -649402,9 +646739,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -649780,9 +647116,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -649801,9 +647136,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -649837,9 +647171,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -649893,9 +647227,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -650271,9 +647604,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -650292,9 +647624,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -650328,9 +647659,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -650384,9 +647715,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -650762,9 +648092,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -650783,9 +648112,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -650819,9 +648147,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -650875,9 +648203,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -651253,9 +648580,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -651274,9 +648600,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -651310,9 +648635,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -651366,9 +648691,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -651744,9 +649068,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -651765,9 +649088,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -651801,9 +649123,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -651857,9 +649179,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -652235,9 +649556,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -652256,9 +649576,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -652292,9 +649611,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -652348,9 +649667,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -652726,9 +650044,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -652747,9 +650064,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -652783,9 +650099,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -652839,9 +650155,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -653217,9 +650532,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -653238,9 +650552,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -653274,9 +650587,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -653330,9 +650643,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -653708,9 +651020,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -653729,9 +651040,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -653765,9 +651075,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -653821,9 +651131,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -654199,9 +651508,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -654220,9 +651528,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -654256,9 +651563,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -654312,9 +651619,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -654690,9 +651996,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -654711,9 +652016,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -654747,9 +652051,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -654803,9 +652107,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -655181,9 +652484,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -655202,9 +652504,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -655238,9 +652539,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -655294,9 +652595,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -655672,9 +652972,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -655693,9 +652992,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -655729,9 +653027,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -655785,9 +653083,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -656163,9 +653460,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -656184,9 +653480,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -656220,9 +653515,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -656276,9 +653571,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -656654,9 +653948,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -656675,9 +653968,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -656711,9 +654003,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -656767,9 +654059,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -657145,9 +654436,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -657166,9 +654456,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -657202,9 +654491,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -657258,9 +654547,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -657636,9 +654924,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -657657,9 +654944,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -657693,9 +654979,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -657749,9 +655035,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -658127,9 +655412,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -658148,9 +655432,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -658184,9 +655467,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -658240,9 +655523,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -658618,9 +655900,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -658639,9 +655920,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -658675,9 +655955,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -658731,9 +656011,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -659109,9 +656388,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -659130,9 +656408,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -659166,9 +656443,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -659222,9 +656499,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -659600,9 +656876,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -659621,9 +656896,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -659657,9 +656931,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -659713,9 +656987,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -660091,9 +657364,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -660112,9 +657384,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -660148,9 +657419,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -660204,9 +657475,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -660582,9 +657852,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -660603,9 +657872,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -660639,9 +657907,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -660695,9 +657963,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -661073,9 +658340,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -661094,9 +658360,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -661130,9 +658395,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -661186,9 +658451,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -661564,9 +658828,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -661585,9 +658848,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -661621,9 +658883,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -661677,9 +658939,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -662055,9 +659316,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -662076,9 +659336,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -662112,9 +659371,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -662168,9 +659427,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -662546,9 +659804,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -662567,9 +659824,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -662603,9 +659859,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -662659,9 +659915,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -663037,9 +660292,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -663058,9 +660312,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -663094,9 +660347,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -663150,9 +660403,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -663528,9 +660780,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -663549,9 +660800,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -663585,9 +660835,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -663641,9 +660891,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -664019,9 +661268,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -664040,9 +661288,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -664076,9 +661323,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -664132,9 +661379,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -664510,9 +661756,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -664531,9 +661776,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -664567,9 +661811,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -664623,9 +661867,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -665001,9 +662244,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -665022,9 +662264,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -665058,9 +662299,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -665114,9 +662355,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -665492,9 +662732,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -665513,9 +662752,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -665549,9 +662787,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -665605,9 +662843,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -665983,9 +663220,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -666004,9 +663240,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -666040,9 +663275,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -666096,9 +663331,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -666474,9 +663708,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -666495,9 +663728,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -666531,9 +663763,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -666587,9 +663819,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -666965,9 +664196,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -666986,9 +664216,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -667022,9 +664251,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -667078,9 +664307,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -667456,9 +664684,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -667477,9 +664704,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -667513,9 +664739,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -667569,9 +664795,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -667947,9 +665172,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -667968,9 +665192,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -668004,9 +665227,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -668060,9 +665283,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -668438,9 +665660,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -668459,9 +665680,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -668495,9 +665715,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -668551,9 +665771,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -668929,9 +666148,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -668950,9 +666168,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -668986,9 +666203,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -669042,9 +666259,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -669420,9 +666636,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -669441,9 +666656,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -669477,9 +666691,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -669533,9 +666747,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -669911,9 +667124,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -669932,9 +667144,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -669968,9 +667179,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -670024,9 +667235,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -670402,9 +667612,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -670423,9 +667632,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -670459,9 +667667,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -670515,9 +667723,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -670893,9 +668100,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -670914,9 +668120,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -670950,9 +668155,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -671006,9 +668211,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -671384,9 +668588,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -671405,9 +668608,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -671441,9 +668643,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -671497,9 +668699,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -671875,9 +669076,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -671896,9 +669096,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -671932,9 +669131,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -671988,9 +669187,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -672366,9 +669564,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -672387,9 +669584,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -672423,9 +669619,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -672479,9 +669675,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -672857,9 +670052,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -672878,9 +670072,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -672914,9 +670107,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -672970,9 +670163,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -673348,9 +670540,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -673369,9 +670560,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -673405,9 +670595,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -673461,9 +670651,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -673839,9 +671028,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -673860,9 +671048,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -673896,9 +671083,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", @@ -673952,9 +671139,8 @@ }, { "techniqueID": "T1110.001", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/high_number_of_login_failures_from_a_single_source.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1216.001", @@ -674330,9 +671516,8 @@ }, { "techniqueID": "T1557.002", - "score": -1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1493", @@ -674351,9 +671536,8 @@ }, { "techniqueID": "T1200", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_ipv6_network_infrastructure_threats.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_port_security_violation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rogue_dhcp_server.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_traffic_mirroring.yml" + "score": 1, + "showSubtechniques": false }, { "techniqueID": "T1556.001", @@ -674387,9 +671571,9 @@ }, { "techniqueID": "T1078.004", - "score": -16, + "score": -14, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml" }, { "techniqueID": "T1564.004", diff --git a/docs/splunk_docs_categories.wiki b/docs/splunk_docs_categories.wiki index 34098b3a90..774b7ba0e9 100644 --- a/docs/splunk_docs_categories.wiki +++ b/docs/splunk_docs_categories.wiki @@ -608,6 +608,9 @@ The detection searches in this Analytic Story monitor access to the Local Securi ====Detections==== * Access LSASS Memory for Dump Creation +* Applying Stolen Credentials via Mimikatz modules +* Applying Stolen Credentials via PowerSploit modules +* Assessment of Credential Strength via DSInternals modules * Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass * Attempted Credential Dump From Registry via Reg exe * Create Remote Thread into LSASS @@ -616,8 +619,19 @@ The detection searches in this Analytic Story monitor access to the Local Securi * Creation of lsass Dump with Taskmgr * Credential Dumping via Copy Command from Shadow Copy * Credential Dumping via Symlink to Shadow Copy +* Credential Extraction indicative of FGDump and CacheDump with s option +* Credential Extraction indicative of FGDump and CacheDump with v option +* Credential Extraction indicative of Lazagne command line options +* Credential Extraction indicative of use of DSInternals credential conversion modules +* Credential Extraction indicative of use of DSInternals modules +* Credential Extraction indicative of use of Mimikatz modules +* Credential Extraction indicative of use of PowerSploit modules +* Credential Extraction native Microsoft debuggers peek into the kernel +* Credential Extraction native Microsoft debuggers via z command line option +* Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals * Detect Credential Dumping through LSASS access * Detect Dump LSASS Memory using comsvcs +* Detect Kerberoasting * Detect Mimikatz Using Loaded Images * Dump LSASS via comsvcs DLL * Dump LSASS via procdump @@ -635,7 +649,23 @@ The detection searches in this Analytic Story monitor access to the Local Securi * T1003.001 * T1003.002 * T1003.003 +* T1055 * T1059.001 +* T1068 +* T1078 +* T1087 +* T1098 +* T1134 +* T1201 +* T1543 +* T1547 +* T1548 +* T1552 +* T1554 +* T1555 +* T1556 +* T1558 +* T1558.003 =====Kill Chain Phases===== * Actions on Objectives @@ -643,6 +673,7 @@ The detection searches in this Analytic Story monitor access to the Local Securi =====CIS===== * CIS 16 +* CIS 20 * CIS 3 * CIS 5 * CIS 6 @@ -944,6 +975,7 @@ The following Splunk detections assist with identifying the HAFNIUM groups trade ====Detections==== * Any Powershell DownloadString * Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass +* Detect Exchange Web Shell * Detect New Local Admin account * Detect PsExec With accepteula Flag * Dump LSASS via comsvcs DLL @@ -1022,6 +1054,7 @@ If there is evidence of lateral movement, it is imperative for analysts to colle ====Detections==== * Detect Activity Related to Pass the Hash Attacks +* Detect Pass the Hash * Kerberoasting spn request with RC4 encryption * Remote Desktop Network Traffic * Remote Desktop Process Running On System @@ -1090,6 +1123,13 @@ In the event a system is suspected of having been compromised via a malicious we * Any Powershell DownloadFile * Any Powershell DownloadString * Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass +* Credential Extraction indicative of use of DSInternals credential conversion modules +* Credential Extraction indicative of use of DSInternals modules +* Credential Extraction indicative of use of PowerSploit modules +* Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals +* Illegal Access To User Content via PowerSploit modules +* Illegal Privilege Elevation and Persistence via PowerSploit modules +* Illegal Service and Process Control via PowerSploit modules * Malicious PowerShell Process - Connect To Internet With Hidden Window * Malicious PowerShell Process - Encoded Command * Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments @@ -1101,8 +1141,19 @@ In the event a system is suspected of having been compromised via a malicious we ====Tags==== =====ATT&CK===== +* T1003 +* T1021 * T1027 +* T1053 +* T1055 * T1059.001 +* T1106 +* T1113 +* T1123 +* T1134 +* T1548 +* T1563 +* T1569 =====Kill Chain Phases===== * Actions on Objectives @@ -1111,12 +1162,15 @@ In the event a system is suspected of having been compromised via a malicious we * Installation =====CIS===== +* CIS 16 +* CIS 20 * CIS 3 * CIS 7 * CIS 8 =====NIST===== * DE.CM +* PR.AC * PR.IP * PR.PT @@ -1131,6 +1185,93 @@ version = 4 +===NOBELIUM Group=== + +Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around the world. + +
+
+ +====Narrative==== +This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) of the NOBELIUM Group. The threat actor behind sunburst compromised the SolarWinds.Orion.Core.BusinessLayer.dll, is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. The detections in this Analytic Story are focusing on the dll loading events, file create events and network events to detect This malware. + +====Detections==== +* Detect Outbound SMB Traffic +* Detect Prohibited Applications Spawning cmd exe +* Detect Rundll32 Inline HTA Execution +* First Time Seen Running Windows Service +* Malicious PowerShell Process - Encoded Command +* Sc exe Manipulating Windows Services +* Scheduled Task Deleted Or Created via CMD +* Schtasks scheduling job on remote system +* Sunburst Correlation DLL and Network Event +* Supernova Webshell +* TOR Traffic +* Windows AdFind Exe + +====Data Models==== +* Endpoint +* Network_Traffic +* Web + +====Tags==== + +=====ATT&CK===== +* T1018 +* T1027 +* T1053.005 +* T1059.003 +* T1071.001 +* T1071.002 +* T1203 +* T1218.005 +* T1505.003 +* T1543.003 +* T1569.002 + +=====Kill Chain Phases===== +* Actions on Objectives +* Command and Control +* Exfiltration +* Exploitation +* Installation + +=====CIS===== +* CIS 12 +* CIS 13 +* CIS 18 +* CIS 2 +* CIS 3 +* CIS 4 +* CIS 5 +* CIS 6 +* CIS 7 +* CIS 8 +* CIS 9 + +=====NIST===== +* DE.AE +* DE.CM +* ID.AM +* ID.RA +* PR.AC +* PR.AT +* PR.DS +* PR.IP +* PR.PT + +====References==== +* https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ +* https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html +* https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/ + +date = 2020-12-14 + +version = 2 + +
+
+ ===Phishing Payloads=== Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack. @@ -1354,90 +1495,6 @@ version = 1 -===Sunburst Malware=== - -Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around the world. - -
-
- -====Narrative==== -This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from the Sunburst malware. The threat actor behind sunburst compromised the SolarWinds.Orion.Core.BusinessLayer.dll, is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. The detections in this Analytic Story are focusing on the dll loading events, file create events and network events to detect This malware. - -====Detections==== -* Detect Outbound SMB Traffic -* Detect Prohibited Applications Spawning cmd exe -* First Time Seen Running Windows Service -* Malicious PowerShell Process - Encoded Command -* Sc exe Manipulating Windows Services -* Scheduled Task Deleted Or Created via CMD -* Schtasks scheduling job on remote system -* Sunburst Correlation DLL and Network Event -* Supernova Webshell -* TOR Traffic -* Windows AdFind Exe - -====Data Models==== -* Endpoint -* Network_Traffic -* Web - -====Tags==== - -=====ATT&CK===== -* T1018 -* T1027 -* T1053.005 -* T1059.003 -* T1071.001 -* T1071.002 -* T1203 -* T1505.003 -* T1543.003 -* T1569.002 - -=====Kill Chain Phases===== -* Actions on Objectives -* Command and Control -* Exfiltration -* Exploitation -* Installation - -=====CIS===== -* CIS 12 -* CIS 13 -* CIS 18 -* CIS 2 -* CIS 3 -* CIS 4 -* CIS 5 -* CIS 6 -* CIS 7 -* CIS 8 -* CIS 9 - -=====NIST===== -* DE.AE -* DE.CM -* ID.AM -* ID.RA -* PR.AC -* PR.AT -* PR.DS -* PR.IP -* PR.PT - -====References==== -* https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html -* https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/ - -date = 2020-12-14 - -version = 1 - -
-
- ===Suspicious Command-Line Executions=== Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems. @@ -1463,6 +1520,7 @@ The ability to execute arbitrary commands via the Windows CLI is a primary goal =====ATT&CK===== * T1036.003 +* T1059 * T1059.001 * T1059.003 @@ -1693,6 +1751,7 @@ The objective of this step is to confirm the executed script code is benign or m ====Tags==== =====ATT&CK===== +* T1059 * T1059.003 * T1218.005 * T1547.001 @@ -2051,6 +2110,7 @@ Current detections focus on finding new child processes of this application on a ====Tags==== =====ATT&CK===== +* T1059 * T1059.003 * T1068 @@ -2204,6 +2264,7 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve * Reg exe used to hide files directories via registry keys * Remote Registry Key modifications * Suspicious Reg exe Process +* System Process Running from Unexpected Location * Windows DisableAntiSpyware Registry ====Data Models==== @@ -2212,6 +2273,7 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve ====Tags==== =====ATT&CK===== +* T1036 * T1112 * T1222.001 * T1548.002 @@ -2241,6 +2303,92 @@ version = 1 +===Windows Discovery Techniques=== + +Monitors for behaviors associated with adversaries discovering objects in the environment that can be leveraged in the progression of the attack. + +
+
+ +====Narrative==== +Attackers may not have much if any insight into their target's environment before the initial compromise. Once a foothold has been established, attackers will start enumerating objects in the environment (accounts, services, network shares, etc.) that can be used to achieve their objectives. This Analytic Story provides searches to help identify activities consistent with adversaries gaining knowledge of compromised Windows environments. + +====Detections==== +* Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules +* Reconnaissance and Access to Accounts and Groups via Mimikatz modules +* Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit modules +* Reconnaissance and Access to Computers and Domains via PowerSploit modules +* Reconnaissance and Access to Computers via Mimikatz modules +* Reconnaissance and Access to Operating System Elements via PowerSploit modules +* Reconnaissance and Access to Processes and Services via Mimikatz modules +* Reconnaissance and Access to Shared Resources via Mimikatz modules +* Reconnaissance and Access to Shared Resources via PowerSploit modules +* Reconnaissance of Access and Persistence Opportunities via PowerSploit modules +* Reconnaissance of Connectivity via PowerSploit modules +* Reconnaissance of Credential Stores and Services via Mimikatz modules +* Reconnaissance of Defensive Tools via PowerSploit modules +* Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules +* Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules + +====Data Models==== + +====Tags==== + +=====ATT&CK===== +* T1007 +* T1012 +* T1021.002 +* T1039 +* T1046 +* T1047 +* T1053 +* T1055 +* T1057 +* T1068 +* T1078 +* T1083 +* T1087 +* T1098 +* T1135 +* T1199 +* T1482 +* T1484 +* T1518 +* T1543 +* T1547 +* T1574 +* T1589.001 +* T1590 +* T1590.001 +* T1590.003 +* T1591 +* T1592 +* T1592.002 +* T1595 +* T1595.002 + +=====Kill Chain Phases===== +* Actions on Objectives + +=====CIS===== +* CIS 16 +* CIS 20 + +=====NIST===== +* PR.AC +* PR.IP + +====References==== +* https://attack.mitre.org/tactics/TA0007/ +* https://cyberd.us/penetration-testing + +date = 2021-03-04 + +version = 1 + +
+
+ ===Windows DNS SIGRed CVE-2020-1350=== Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpoint researchers, this vulnerability affects Windows 2003 to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP). An attacker can use the malicious payload to cause a buffer overflow on the vulnerable system, leading to compromise. The included searches in this Analytic Story are designed to identify the large response payload for SIG and KEY DNS records which can be used for the exploit. @@ -2298,6 +2446,7 @@ The Analytic Story gives users two different ways to detect manipulation of Wind ====Detections==== * Deleting Shadow Copies +* Illegal Deletion of Logs via Mimikatz modules * Suspicious wevtutil Usage * USN Journal Deletion * Windows Event Log Cleared @@ -2317,6 +2466,8 @@ The Analytic Story gives users two different ways to detect manipulation of Wind =====CIS===== * CIS 10 +* CIS 16 +* CIS 20 * CIS 3 * CIS 5 * CIS 6 @@ -2357,6 +2508,11 @@ Maintaining persistence is one of the first steps taken by attackers after the i * Certutil exe certificate extraction * Detect Path Interception By Creation Of program exe * Hiding Files And Directories With Attrib exe +* Illegal Account Creation via PowerSploit modules +* Illegal Enabling or Disabling of Accounts via DSInternals modules +* Illegal Management of Active Directory Elements and Policies via DSInternals modules +* Illegal Management of Computers and Active Directory Elements via PowerSploit modules +* Illegal Privilege Elevation and Persistence via PowerSploit modules * Monitor Registry Keys for Print Monitors * Reg exe Manipulating Windows Services Registry Keys * Reg exe used to hide files directories via registry keys @@ -2365,6 +2521,9 @@ Maintaining persistence is one of the first steps taken by attackers after the i * Remote Registry Key modifications * Sc exe Manipulating Windows Services * Schtasks used for forcing a reboot +* Setting Credentials via DSInternals modules +* Setting Credentials via Mimikatz modules +* Setting Credentials via PowerSploit modules * Shim Database File Creation * Shim Database Installation With Suspicious Parameters * Suspicious Scheduled Task from Public Directory @@ -2375,15 +2534,24 @@ Maintaining persistence is one of the first steps taken by attackers after the i ====Tags==== =====ATT&CK===== +* T1053 * T1053.005 +* T1068 +* T1078 +* T1098 +* T1134 +* T1207 * T1222.001 +* T1484 * T1543.003 * T1546.011 * T1547.001 * T1547.010 +* T1548 * T1564.001 * T1574.009 * T1574.011 +* T1585 =====Kill Chain Phases===== * Actions on Objectives @@ -2392,6 +2560,8 @@ Maintaining persistence is one of the first steps taken by attackers after the i * Privilege Escalation =====CIS===== +* CIS 16 +* CIS 20 * CIS 3 * CIS 5 * CIS 8 @@ -2430,7 +2600,9 @@ Privilege escalation is a "land-and-expand" technique, wherein an adversary gain ====Detections==== * Child Processes of Spoolsv exe +* Illegal Privilege Elevation via Mimikatz modules * Overwriting Accessibility Binaries +* Probing Access with Stolen Credentials via PowerSploit modules * Registry Keys Used For Privilege Escalation * Uncommon Processes On Endpoint @@ -2441,16 +2613,22 @@ Privilege escalation is a "land-and-expand" technique, wherein an adversary gain =====ATT&CK===== * T1068 +* T1078 +* T1098 +* T1134 * T1204.002 * T1546.008 * T1546.012 +* T1548 =====Kill Chain Phases===== * Actions on Objectives * Exploitation =====CIS===== +* CIS 16 * CIS 2 +* CIS 20 * CIS 5 * CIS 8 @@ -2459,6 +2637,7 @@ Privilege escalation is a "land-and-expand" technique, wherein an adversary gain * ID.AM * PR.AC * PR.DS +* PR.IP * PR.PT ====References==== @@ -3153,7 +3332,6 @@ This story is composed of detection searches based on endpoint that addresses th * O365 Excessive SSO logon errors * O365 New Federated Domain Added * Registry Keys Used For Privilege Escalation -* Uncommon Processes On Endpoint ====Data Models==== * Endpoint @@ -3164,7 +3342,6 @@ This story is composed of detection searches based on endpoint that addresses th * T1003.001 * T1078 * T1136.003 -* T1204.002 * T1546.012 * T1556 @@ -4623,8 +4800,16 @@ This Analytic Story lets you identify processes that are either a) not typically In the event an unusual process is identified, it is imperative to better understand how that process was able to execute on the host, when it first executed, and whether other hosts are affected. This extra information may provide clues that can help the analyst further investigate any suspicious activity. ====Detections==== +* Credential Extraction indicative of FGDump and CacheDump with s option +* Credential Extraction indicative of FGDump and CacheDump with v option +* Credential Extraction indicative of use of Mimikatz modules +* Credential Extraction native Microsoft debuggers peek into the kernel +* Credential Extraction native Microsoft debuggers via z command line option * Detect Rare Executables * Detect processes used for System Network Configuration Discovery +* First time seen command line argument +* More than usual number of LOLBAS applications in short time period +* Rare Parent-Child Process Relationship * RunDLL Loading DLL By Ordinal * System Processes Run From Unexpected Locations * Uncommon Processes On Endpoint @@ -4637,24 +4822,36 @@ In the event an unusual process is identified, it is imperative to better unders ====Tags==== =====ATT&CK===== +* T1003 * T1016 * T1036.003 +* T1053 +* T1059 +* T1072 +* T1117 +* T1202 +* T1203 * T1204.002 * T1218.011 =====Kill Chain Phases===== * Actions on Objectives * Command and Control +* Exploitation * Installation =====CIS===== +* CIS 16 * CIS 2 +* CIS 3 * CIS 8 =====NIST===== * DE.CM * ID.AM +* PR.AC * PR.DS +* PR.IP * PR.PT ====References==== @@ -4732,6 +4929,8 @@ The Windows operating system uses a services architecture to allow for running c ====Detections==== * First Time Seen Running Windows Service +* Illegal Service and Process Control via Mimikatz modules +* Illegal Service and Process Control via PowerSploit modules * Reg exe Manipulating Windows Services Registry Keys * Sc exe Manipulating Windows Services @@ -4741,7 +4940,10 @@ The Windows operating system uses a services architecture to allow for running c ====Tags==== =====ATT&CK===== +* T1055 +* T1106 * T1543.003 +* T1569 * T1569.002 * T1574.011 @@ -4750,7 +4952,9 @@ The Windows operating system uses a services architecture to allow for running c * Installation =====CIS===== +* CIS 16 * CIS 2 +* CIS 20 * CIS 3 * CIS 5 * CIS 8 diff --git a/docs/stories_categories.md b/docs/stories_categories.md index 50839eec99..7ab414ce05 100644 --- a/docs/stories_categories.md +++ b/docs/stories_categories.md @@ -320,6 +320,8 @@ Another search detects incidents wherein a single password is used across multip * [Malicious PowerShell](#Malicious-PowerShell) +* [NOBELIUM Group](#NOBELIUM-Group) + * [Phishing Payloads](#Phishing-Payloads) * [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](#Possible-Backdoor-Activity-Associated-With-MUDCARP-Espionage-Campaigns) @@ -328,8 +330,6 @@ Another search detects incidents wherein a single password is used across multip * [SQL Injection](#SQL-Injection) -* [Sunburst Malware](#Sunburst-Malware) - * [Suspicious Command-Line Executions](#Suspicious-Command-Line-Executions) * [Suspicious Compiled HTML Activity](#Suspicious-Compiled-HTML-Activity) @@ -360,6 +360,8 @@ Another search detects incidents wherein a single password is used across multip * [Windows Defense Evasion Tactics](#Windows-Defense-Evasion-Tactics) +* [Windows Discovery Techniques](#Windows-Discovery-Techniques) + * [Windows DNS SIGRed CVE-2020-1350](#Windows-DNS-SIGRed-CVE-2020-1350) * [Windows Log Manipulation](#Windows-Log-Manipulation) @@ -644,6 +646,9 @@ The detection searches in this Analytic Story monitor access to the Local Securi #### Detections * Access LSASS Memory for Dump Creation +* Applying Stolen Credentials via Mimikatz modules +* Applying Stolen Credentials via PowerSploit modules +* Assessment of Credential Strength via DSInternals modules * Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass * Attempted Credential Dump From Registry via Reg exe * Create Remote Thread into LSASS @@ -652,8 +657,19 @@ The detection searches in this Analytic Story monitor access to the Local Securi * Creation of lsass Dump with Taskmgr * Credential Dumping via Copy Command from Shadow Copy * Credential Dumping via Symlink to Shadow Copy +* Credential Extraction indicative of FGDump and CacheDump with s option +* Credential Extraction indicative of FGDump and CacheDump with v option +* Credential Extraction indicative of Lazagne command line options +* Credential Extraction indicative of use of DSInternals credential conversion modules +* Credential Extraction indicative of use of DSInternals modules +* Credential Extraction indicative of use of Mimikatz modules +* Credential Extraction indicative of use of PowerSploit modules +* Credential Extraction native Microsoft debuggers peek into the kernel +* Credential Extraction native Microsoft debuggers via z command line option +* Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals * Detect Credential Dumping through LSASS access * Detect Dump LSASS Memory using comsvcs +* Detect Kerberoasting * Detect Mimikatz Using Loaded Images * Dump LSASS via comsvcs DLL * Dump LSASS via procdump @@ -671,7 +687,23 @@ The detection searches in this Analytic Story monitor access to the Local Securi * T1003.001 * T1003.002 * T1003.003 +* T1055 * T1059.001 +* T1068 +* T1078 +* T1087 +* T1098 +* T1134 +* T1201 +* T1543 +* T1547 +* T1548 +* T1552 +* T1554 +* T1555 +* T1556 +* T1558 +* T1558.003 ##### Kill Chain Phases * Actions on Objectives @@ -679,6 +711,7 @@ The detection searches in this Analytic Story monitor access to the Local Securi ###### CIS * CIS 16 +* CIS 20 * CIS 3 * CIS 5 * CIS 6 @@ -944,6 +977,7 @@ The following Splunk detections assist with identifying the HAFNIUM groups trade #### Detections * Any Powershell DownloadString * Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass +* Detect Exchange Web Shell * Detect New Local Admin account * Detect PsExec With accepteula Flag * Dump LSASS via comsvcs DLL @@ -1016,6 +1050,7 @@ If there is evidence of lateral movement, it is imperative for analysts to colle #### Detections * Detect Activity Related to Pass the Hash Attacks +* Detect Pass the Hash * Kerberoasting spn request with RC4 encryption * Remote Desktop Network Traffic * Remote Desktop Process Running On System @@ -1078,6 +1113,13 @@ In the event a system is suspected of having been compromised via a malicious we * Any Powershell DownloadFile * Any Powershell DownloadString * Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass +* Credential Extraction indicative of use of DSInternals credential conversion modules +* Credential Extraction indicative of use of DSInternals modules +* Credential Extraction indicative of use of PowerSploit modules +* Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals +* Illegal Access To User Content via PowerSploit modules +* Illegal Privilege Elevation and Persistence via PowerSploit modules +* Illegal Service and Process Control via PowerSploit modules * Malicious PowerShell Process - Connect To Internet With Hidden Window * Malicious PowerShell Process - Encoded Command * Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments @@ -1089,8 +1131,19 @@ In the event a system is suspected of having been compromised via a malicious we #### Mappings ##### ATT&CK +* T1003 +* T1021 * T1027 +* T1053 +* T1055 * T1059.001 +* T1106 +* T1113 +* T1123 +* T1134 +* T1548 +* T1563 +* T1569 ##### Kill Chain Phases * Actions on Objectives @@ -1099,12 +1152,15 @@ In the event a system is suspected of having been compromised via a malicious we * Installation ###### CIS +* CIS 16 +* CIS 20 * CIS 3 * CIS 7 * CIS 8 ##### NIST * DE.CM +* PR.AC * PR.IP * PR.PT @@ -1112,6 +1168,87 @@ In the event a system is suspected of having been compromised via a malicious we * https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/ * https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ +### NOBELIUM Group +* id = 758196b5-2e21-424f-a50c-6e421ce926c2 +* date = 2020-12-14 +* version = 2 + +#### Description +Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around the world. + +#### Narrative +This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) of the NOBELIUM Group. The threat actor behind sunburst compromised the SolarWinds.Orion.Core.BusinessLayer.dll, is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. The detections in this Analytic Story are focusing on the dll loading events, file create events and network events to detect This malware. + +#### Detections +* Detect Outbound SMB Traffic +* Detect Prohibited Applications Spawning cmd exe +* Detect Rundll32 Inline HTA Execution +* First Time Seen Running Windows Service +* Malicious PowerShell Process - Encoded Command +* Sc exe Manipulating Windows Services +* Scheduled Task Deleted Or Created via CMD +* Schtasks scheduling job on remote system +* Sunburst Correlation DLL and Network Event +* Supernova Webshell +* TOR Traffic +* Windows AdFind Exe + +#### Data Models +* Endpoint +* Network_Traffic +* Web + +#### Mappings + +##### ATT&CK +* T1018 +* T1027 +* T1053.005 +* T1059.003 +* T1071.001 +* T1071.002 +* T1203 +* T1218.005 +* T1505.003 +* T1543.003 +* T1569.002 + +##### Kill Chain Phases +* Actions on Objectives +* Command and Control +* Exfiltration +* Exploitation +* Installation + +###### CIS +* CIS 12 +* CIS 13 +* CIS 18 +* CIS 2 +* CIS 3 +* CIS 4 +* CIS 5 +* CIS 6 +* CIS 7 +* CIS 8 +* CIS 9 + +##### NIST +* DE.AE +* DE.CM +* ID.AM +* ID.RA +* PR.AC +* PR.AT +* PR.DS +* PR.IP +* PR.PT + +##### References +* https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ +* https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html +* https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/ + ### Phishing Payloads * id = 57226b40-94f3-4ce5-b101-a75f67759c27 * date = 2019-04-29 @@ -1311,84 +1448,6 @@ This Analytic Story contains a search designed to identify attempts by attackers * https://capec.mitre.org/data/definitions/66.html * https://www.incapsula.com/web-application-security/sql-injection.html -### Sunburst Malware -* id = 758196b5-2e21-424f-a50c-6e421ce926c2 -* date = 2020-12-14 -* version = 1 - -#### Description -Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around the world. - -#### Narrative -This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from the Sunburst malware. The threat actor behind sunburst compromised the SolarWinds.Orion.Core.BusinessLayer.dll, is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. The detections in this Analytic Story are focusing on the dll loading events, file create events and network events to detect This malware. - -#### Detections -* Detect Outbound SMB Traffic -* Detect Prohibited Applications Spawning cmd exe -* First Time Seen Running Windows Service -* Malicious PowerShell Process - Encoded Command -* Sc exe Manipulating Windows Services -* Scheduled Task Deleted Or Created via CMD -* Schtasks scheduling job on remote system -* Sunburst Correlation DLL and Network Event -* Supernova Webshell -* TOR Traffic -* Windows AdFind Exe - -#### Data Models -* Endpoint -* Network_Traffic -* Web - -#### Mappings - -##### ATT&CK -* T1018 -* T1027 -* T1053.005 -* T1059.003 -* T1071.001 -* T1071.002 -* T1203 -* T1505.003 -* T1543.003 -* T1569.002 - -##### Kill Chain Phases -* Actions on Objectives -* Command and Control -* Exfiltration -* Exploitation -* Installation - -###### CIS -* CIS 12 -* CIS 13 -* CIS 18 -* CIS 2 -* CIS 3 -* CIS 4 -* CIS 5 -* CIS 6 -* CIS 7 -* CIS 8 -* CIS 9 - -##### NIST -* DE.AE -* DE.CM -* ID.AM -* ID.RA -* PR.AC -* PR.AT -* PR.DS -* PR.IP -* PR.PT - -##### References -* https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html -* https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/ - ### Suspicious Command-Line Executions * id = f4368ddf-d59f-4192-84f6-778ac5a3ffc7 * date = 2020-02-03 @@ -1415,6 +1474,7 @@ The ability to execute arbitrary commands via the Windows CLI is a primary goal ##### ATT&CK * T1036.003 +* T1059 * T1059.001 * T1059.003 @@ -1621,6 +1681,7 @@ The objective of this step is to confirm the executed script code is benign or m #### Mappings ##### ATT&CK +* T1059 * T1059.003 * T1218.005 * T1547.001 @@ -1937,6 +1998,7 @@ Current detections focus on finding new child processes of this application on a #### Mappings ##### ATT&CK +* T1059 * T1059.003 * T1068 @@ -2072,6 +2134,7 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve * Reg exe used to hide files directories via registry keys * Remote Registry Key modifications * Suspicious Reg exe Process +* System Process Running from Unexpected Location * Windows DisableAntiSpyware Registry #### Data Models @@ -2080,6 +2143,7 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve #### Mappings ##### ATT&CK +* T1036 * T1112 * T1222.001 * T1548.002 @@ -2102,6 +2166,86 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve ##### References * https://attack.mitre.org/wiki/Defense_Evasion +### Windows Discovery Techniques +* id = f7aba570-7d59-11eb-825e-acde48001122 +* date = 2021-03-04 +* version = 1 + +#### Description +Monitors for behaviors associated with adversaries discovering objects in the environment that can be leveraged in the progression of the attack. + +#### Narrative +Attackers may not have much if any insight into their target's environment before the initial compromise. Once a foothold has been established, attackers will start enumerating objects in the environment (accounts, services, network shares, etc.) that can be used to achieve their objectives. This Analytic Story provides searches to help identify activities consistent with adversaries gaining knowledge of compromised Windows environments. + +#### Detections +* Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules +* Reconnaissance and Access to Accounts and Groups via Mimikatz modules +* Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit modules +* Reconnaissance and Access to Computers and Domains via PowerSploit modules +* Reconnaissance and Access to Computers via Mimikatz modules +* Reconnaissance and Access to Operating System Elements via PowerSploit modules +* Reconnaissance and Access to Processes and Services via Mimikatz modules +* Reconnaissance and Access to Shared Resources via Mimikatz modules +* Reconnaissance and Access to Shared Resources via PowerSploit modules +* Reconnaissance of Access and Persistence Opportunities via PowerSploit modules +* Reconnaissance of Connectivity via PowerSploit modules +* Reconnaissance of Credential Stores and Services via Mimikatz modules +* Reconnaissance of Defensive Tools via PowerSploit modules +* Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules +* Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules + +#### Data Models + +#### Mappings + +##### ATT&CK +* T1007 +* T1012 +* T1021.002 +* T1039 +* T1046 +* T1047 +* T1053 +* T1055 +* T1057 +* T1068 +* T1078 +* T1083 +* T1087 +* T1098 +* T1135 +* T1199 +* T1482 +* T1484 +* T1518 +* T1543 +* T1547 +* T1574 +* T1589.001 +* T1590 +* T1590.001 +* T1590.003 +* T1591 +* T1592 +* T1592.002 +* T1595 +* T1595.002 + +##### Kill Chain Phases +* Actions on Objectives + +###### CIS +* CIS 16 +* CIS 20 + +##### NIST +* PR.AC +* PR.IP + +##### References +* https://attack.mitre.org/tactics/TA0007/ +* https://cyberd.us/penetration-testing + ### Windows DNS SIGRed CVE-2020-1350 * id = 36dbb206-d073-11ea-87d0-0242ac130003 * date = 2020-07-28 @@ -2154,6 +2298,7 @@ The Analytic Story gives users two different ways to detect manipulation of Wind #### Detections * Deleting Shadow Copies +* Illegal Deletion of Logs via Mimikatz modules * Suspicious wevtutil Usage * USN Journal Deletion * Windows Event Log Cleared @@ -2173,6 +2318,8 @@ The Analytic Story gives users two different ways to detect manipulation of Wind ###### CIS * CIS 10 +* CIS 16 +* CIS 20 * CIS 3 * CIS 5 * CIS 6 @@ -2207,6 +2354,11 @@ Maintaining persistence is one of the first steps taken by attackers after the i * Certutil exe certificate extraction * Detect Path Interception By Creation Of program exe * Hiding Files And Directories With Attrib exe +* Illegal Account Creation via PowerSploit modules +* Illegal Enabling or Disabling of Accounts via DSInternals modules +* Illegal Management of Active Directory Elements and Policies via DSInternals modules +* Illegal Management of Computers and Active Directory Elements via PowerSploit modules +* Illegal Privilege Elevation and Persistence via PowerSploit modules * Monitor Registry Keys for Print Monitors * Reg exe Manipulating Windows Services Registry Keys * Reg exe used to hide files directories via registry keys @@ -2215,6 +2367,9 @@ Maintaining persistence is one of the first steps taken by attackers after the i * Remote Registry Key modifications * Sc exe Manipulating Windows Services * Schtasks used for forcing a reboot +* Setting Credentials via DSInternals modules +* Setting Credentials via Mimikatz modules +* Setting Credentials via PowerSploit modules * Shim Database File Creation * Shim Database Installation With Suspicious Parameters * Suspicious Scheduled Task from Public Directory @@ -2225,15 +2380,24 @@ Maintaining persistence is one of the first steps taken by attackers after the i #### Mappings ##### ATT&CK +* T1053 * T1053.005 +* T1068 +* T1078 +* T1098 +* T1134 +* T1207 * T1222.001 +* T1484 * T1543.003 * T1546.011 * T1547.001 * T1547.010 +* T1548 * T1564.001 * T1574.009 * T1574.011 +* T1585 ##### Kill Chain Phases * Actions on Objectives @@ -2242,6 +2406,8 @@ Maintaining persistence is one of the first steps taken by attackers after the i * Privilege Escalation ###### CIS +* CIS 16 +* CIS 20 * CIS 3 * CIS 5 * CIS 8 @@ -2274,7 +2440,9 @@ Privilege escalation is a "land-and-expand" technique, wherein an adversary gain #### Detections * Child Processes of Spoolsv exe +* Illegal Privilege Elevation via Mimikatz modules * Overwriting Accessibility Binaries +* Probing Access with Stolen Credentials via PowerSploit modules * Registry Keys Used For Privilege Escalation * Uncommon Processes On Endpoint @@ -2285,16 +2453,22 @@ Privilege escalation is a "land-and-expand" technique, wherein an adversary gain ##### ATT&CK * T1068 +* T1078 +* T1098 +* T1134 * T1204.002 * T1546.008 * T1546.012 +* T1548 ##### Kill Chain Phases * Actions on Objectives * Exploitation ###### CIS +* CIS 16 * CIS 2 +* CIS 20 * CIS 5 * CIS 8 @@ -2303,6 +2477,7 @@ Privilege escalation is a "land-and-expand" technique, wherein an adversary gain * ID.AM * PR.AC * PR.DS +* PR.IP * PR.PT ##### References @@ -2969,7 +3144,6 @@ This story is composed of detection searches based on endpoint that addresses th * O365 Excessive SSO logon errors * O365 New Federated Domain Added * Registry Keys Used For Privilege Escalation -* Uncommon Processes On Endpoint #### Data Models * Endpoint @@ -2980,7 +3154,6 @@ This story is composed of detection searches based on endpoint that addresses th * T1003.001 * T1078 * T1136.003 -* T1204.002 * T1546.012 * T1556 @@ -4303,8 +4476,16 @@ This Analytic Story lets you identify processes that are either a) not typically In the event an unusual process is identified, it is imperative to better understand how that process was able to execute on the host, when it first executed, and whether other hosts are affected. This extra information may provide clues that can help the analyst further investigate any suspicious activity. #### Detections +* Credential Extraction indicative of FGDump and CacheDump with s option +* Credential Extraction indicative of FGDump and CacheDump with v option +* Credential Extraction indicative of use of Mimikatz modules +* Credential Extraction native Microsoft debuggers peek into the kernel +* Credential Extraction native Microsoft debuggers via z command line option * Detect Rare Executables * Detect processes used for System Network Configuration Discovery +* First time seen command line argument +* More than usual number of LOLBAS applications in short time period +* Rare Parent-Child Process Relationship * RunDLL Loading DLL By Ordinal * System Processes Run From Unexpected Locations * Uncommon Processes On Endpoint @@ -4317,24 +4498,36 @@ In the event an unusual process is identified, it is imperative to better unders #### Mappings ##### ATT&CK +* T1003 * T1016 * T1036.003 +* T1053 +* T1059 +* T1072 +* T1117 +* T1202 +* T1203 * T1204.002 * T1218.011 ##### Kill Chain Phases * Actions on Objectives * Command and Control +* Exploitation * Installation ###### CIS +* CIS 16 * CIS 2 +* CIS 3 * CIS 8 ##### NIST * DE.CM * ID.AM +* PR.AC * PR.DS +* PR.IP * PR.PT ##### References @@ -4400,6 +4593,8 @@ The Windows operating system uses a services architecture to allow for running c #### Detections * First Time Seen Running Windows Service +* Illegal Service and Process Control via Mimikatz modules +* Illegal Service and Process Control via PowerSploit modules * Reg exe Manipulating Windows Services Registry Keys * Sc exe Manipulating Windows Services @@ -4409,7 +4604,10 @@ The Windows operating system uses a services architecture to allow for running c #### Mappings ##### ATT&CK +* T1055 +* T1106 * T1543.003 +* T1569 * T1569.002 * T1574.011 @@ -4418,7 +4616,9 @@ The Windows operating system uses a services architecture to allow for running c * Installation ###### CIS +* CIS 16 * CIS 2 +* CIS 20 * CIS 3 * CIS 5 * CIS 8 diff --git a/package/app.manifest b/package/app.manifest index c3132cc18d..4d24968033 100644 --- a/package/app.manifest +++ b/package/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "DA-ESS-ContentUpdate", - "version": "3.16.0" + "version": "3.17.0" }, "author": [ { diff --git a/package/default/analytic_stories.conf b/package/default/analytic_stories.conf index a212517901..cca07d1910 100644 --- a/package/default/analytic_stories.conf +++ b/package/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-03-04T19:43:30 UTC +# On Date: 2021-03-12T17:19:06 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -34,8 +34,8 @@ version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]} -investigative_searches = ["ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task"] -support_searches = ["ESCU - Previously Seen EC2 Launches By User", "ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 AMIs", "ESCU - Previously Seen EC2 Instance Types"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] +support_searches = ["ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Previously Seen EC2 AMIs", "ESCU - Previously Seen EC2 Instance Types", "ESCU - Previously Seen AWS Regions"] data_models = [] providing_technologies = none description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior. @@ -53,7 +53,7 @@ version = 2 reference = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] detection_searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"] mappings = {"cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1562.007"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC"]} -investigative_searches = ["ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = ["ESCU - Baseline of Network ACL Activity by ARN", "ESCU - Baseline of blocked outbound traffic from AWS"] data_models = [] providing_technologies = none @@ -69,7 +69,7 @@ version = 1 reference = ["https://aws.amazon.com/security-hub/features/"] detection_searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule"] mappings = {"cis20": ["CIS 13"], "nist": ["DE.AE", "DE.DP"]} -investigative_searches = ["ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] support_searches = [] data_models = [] providing_technologies = none @@ -85,7 +85,7 @@ version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] detection_searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule"] mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]} -investigative_searches = ["ESCU - Get All AWS Activity From City - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Get All AWS Activity From Region - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +investigative_searches = ["ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Get All AWS Activity From Region - Response Task", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] support_searches = ["ESCU - Previously Seen AWS Provisioning Activity Sources"] data_models = [] providing_technologies = none @@ -102,8 +102,8 @@ version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] detection_searches = ["ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule"] mappings = {"cis20": ["CIS 1", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC"]} -investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] -support_searches = ["ESCU - Previously seen API call per user roles in CloudTrail", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Baseline of API Calls per User ARN", "ESCU - Create a list of approved AWS service accounts"] +investigative_searches = ["ESCU - Investigate AWS User Activities by user field - Response Task", "ESCU - Get Notable History - Response Task"] +support_searches = ["ESCU - Create a list of approved AWS service accounts", "ESCU - Baseline of API Calls per User ARN", "ESCU - Previously seen API call per user roles in CloudTrail", "ESCU - Baseline of Security Group Activity by ARN"] data_models = [] providing_technologies = none description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment. @@ -121,7 +121,7 @@ version = 1 reference = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"] detection_searches = ["ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule"] mappings = {"cis20": ["CIS 12", "CIS 18", "CIS 3", "CIS 4", "CIS 7"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation"], "mitre_attack": ["T1082"], "nist": ["DE.AE", "DE.CM", "ID.RA", "PR.IP", "PR.MA", "PR.PT", "RS.MI"]} -investigative_searches = ["ESCU - Investigate Web POSTs From src - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task"] +investigative_searches = ["ESCU - Investigate Web POSTs From src - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -150,7 +150,7 @@ version = 1 reference = ["https://www.cisecurity.org/controls/inventory-of-authorized-and-unauthorized-devices/"] detection_searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule"] mappings = {"cis20": ["CIS 1"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Reconnaissance"], "nist": ["ID.AM", "PR.DS"]} -investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Response Task"] +investigative_searches = ["ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = ["ESCU - Count of assets by category"] data_models = ["Network_Sessions"] providing_technologies = none @@ -182,7 +182,7 @@ version = 1 reference = ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"] detection_searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule"] mappings = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives", "Delivery"], "nist": ["PR.IP"]} -investigative_searches = ["ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Email Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = ["ESCU - DNSTwist Domain Names"] data_models = ["Email", "Network_Resolution", "Web"] providing_technologies = none @@ -200,8 +200,8 @@ version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]} -investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task"] -support_searches = ["ESCU - Previously Seen Cloud Compute Instance Types - Update", "ESCU - Previously Seen Cloud Compute Images - Update", "ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Compute Images - Initial", "ESCU - Previously Seen Cloud Compute Instance Types - Initial", "ESCU - Previously Seen Cloud Regions - Update", "ESCU - Previously Seen Cloud Regions - Initial", "ESCU - Previously Seen Cloud Compute Creations By User - Update", "ESCU - Previously Seen Cloud Compute Creations By User - Initial"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] +support_searches = ["ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Compute Creations By User - Initial", "ESCU - Previously Seen Cloud Compute Instance Types - Initial", "ESCU - Previously Seen Cloud Compute Images - Initial", "ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Previously Seen Cloud Compute Creations By User - Update", "ESCU - Previously Seen Cloud Regions - Update", "ESCU - Previously Seen Cloud Regions - Initial", "ESCU - Previously Seen Cloud Compute Images - Update", "ESCU - Previously Seen Cloud Compute Instance Types - Update"] data_models = ["Change"] providing_technologies = none description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. @@ -217,8 +217,8 @@ modification_date = 2021-01-26 id = cecdc1e7-0af2-4a55-8967-b9ea62c0317d version = 1 reference = ["https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps", "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf", "https://us-cert.cisa.gov/ncas/alerts/aa21-008a"] -detection_searches = ["ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule"] -mappings = {"cis20": ["CIS 16", "CIS 2", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1003.001", "T1078", "T1136.003", "T1204.002", "T1546.012", "T1556"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]} +detection_searches = ["ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule"] +mappings = {"cis20": ["CIS 16", "CIS 2", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1003.001", "T1078", "T1136.003", "T1546.012", "T1556"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = [] support_searches = [] data_models = ["Endpoint"] @@ -260,7 +260,7 @@ version = 1 reference = ["https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/", "https://objective-see.com/blog/blog_0x2A.html", "https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/"] detection_searches = ["ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule"] mappings = {"cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Command and Control", "Installation"], "nist": ["DE.CM", "DE.DP", "PR.PT"]} -investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"] +investigative_searches = ["ESCU - Investigate Network Traffic From src ip - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = [] data_models = [] providing_technologies = none @@ -278,7 +278,7 @@ version = 1 reference = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"] detection_searches = ["ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule"] mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036", "T1114.001", "T1114.002"], "nist": ["DE.AE", "DE.CM", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = [] data_models = ["Endpoint", "Network_Traffic"] providing_technologies = none @@ -296,7 +296,7 @@ version = 1 reference = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"] detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"] mappings = {"cis20": ["CIS 1", "CIS 11", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery"], "mitre_attack": ["T1048", "T1048.003", "T1071.001", "T1071.004", "T1095", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = ["ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of blocked outbound traffic from AWS"] data_models = ["Network_Resolution", "Network_Traffic"] providing_technologies = none @@ -313,7 +313,7 @@ version = 1 reference = ["https://github.com/kgretzky/evilginx2", "https://attack.mitre.org/techniques/T1192/", "https://breakdev.org/evilginx-advanced-phishing-with-two-factor-authentication-bypass/"] detection_searches = ["ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule"] mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Delivery"], "mitre_attack": ["T1566.003"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP"]} -investigative_searches = ["ESCU - Domain Certificate Investigation - Response Task", "ESCU - Get Certificate logs for a domain - Response Task"] +investigative_searches = ["ESCU - Get Certificate logs for a domain - Response Task", "ESCU - Domain Certificate Investigation - Response Task"] support_searches = [] data_models = ["Network_Resolution"] providing_technologies = none @@ -346,7 +346,7 @@ version = 3 reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"] mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1003.001", "T1003.002", "T1003.003", "T1059.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]} -investigative_searches = ["ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task"] +investigative_searches = ["ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Previous Unseen User - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -364,8 +364,8 @@ version = 2 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"] detection_searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule"] mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 2", "CIS 3", "CIS 5", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1021.002", "T1053.005", "T1059.001", "T1059.003", "T1071.002", "T1112", "T1136.001", "T1204.002", "T1543.003", "T1547.001", "T1562.004"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] -support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"] +investigative_searches = ["ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] +support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of SMB Traffic - MLTK"] data_models = ["Endpoint", "Network_Traffic"] providing_technologies = none description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more. @@ -440,7 +440,7 @@ version = 1 reference = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"] detection_searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule"] mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1048.003", "T1189"], "nist": ["DE.AE", "DE.CM", "PR.DS", "PR.PT"]} -investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = [] data_models = ["Change_Analysis", "Network_Resolution"] providing_technologies = none @@ -472,8 +472,8 @@ version = 2 reference = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"] detection_searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule"] mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1112", "T1543.003", "T1553.004", "T1562.001", "T1562.004"], "nist": ["DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] -support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of SMB Traffic - MLTK"] data_models = ["Endpoint"] providing_technologies = none description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others. @@ -504,7 +504,7 @@ version = 1 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"] detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"] mappings = {"cis20": ["CIS 12", "CIS 2", "CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exploitation", "Installation"], "mitre_attack": ["T1021.002", "T1059.003", "T1072", "T1547.001", "T1566.001"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +investigative_searches = ["ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task"] support_searches = ["ESCU - Baseline of SMB Traffic - MLTK"] data_models = ["Email", "Endpoint", "Network_Traffic"] providing_technologies = none @@ -554,7 +554,7 @@ modification_date = 2021-03-03 id = beae2ab0-7c3f-11eb-8b63-acde48001122 version = 1 reference = ["https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html", "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/", "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/", "https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/"] -detection_searches = ["ESCU - Any Powershell DownloadString - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Nishang PowershellTCPOneLine - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - W3WP Spawning Shell - Rule"] +detection_searches = ["ESCU - Any Powershell DownloadString - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Detect Exchange Web Shell - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Nishang PowershellTCPOneLine - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - W3WP Spawning Shell - Rule"] mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation", "Installation"], "mitre_attack": ["T1003.001", "T1003.003", "T1021.002", "T1059.001", "T1114.002", "T1136.001", "T1190", "T1505.003"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]} investigative_searches = [] support_searches = [] @@ -574,8 +574,8 @@ version = 2 reference = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"] detection_searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule"] mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1021.001", "T1021.002", "T1048.003", "T1059.001", "T1059.003", "T1070.005", "T1071.002", "T1071.004"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] -support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Previously seen command line arguments"] +investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK"] data_models = ["Endpoint", "Network_Resolution", "Network_Traffic"] providing_technologies = none description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A. @@ -639,7 +639,7 @@ version = 1 reference = ["https://github.com/splunk/cloud-datamodel-security-research"] detection_searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule"] mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} -investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task"] +investigative_searches = ["ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = [] data_models = [] providing_technologies = none @@ -687,7 +687,7 @@ version = 2 reference = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"] detection_searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule"] mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001", "T1053.005", "T1550.002", "T1558.003"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +investigative_searches = ["ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task"] support_searches = [] data_models = ["Endpoint", "Network_Traffic"] providing_technologies = none @@ -707,7 +707,7 @@ version = 4 reference = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] detection_searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule"] mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation", "Installation"], "mitre_attack": ["T1027", "T1059.001"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -732,7 +732,7 @@ version = 1 reference = ["https://www.carbonblack.com/2016/03/04/tracking-locky-ransomware-using-carbon-black/"] detection_searches = ["ESCU - Extended Period Without Successful Netbackup Backups - Rule", "ESCU - Unsuccessful Netbackup backups - Rule"] mappings = {"cis20": ["CIS 10"], "nist": ["PR.IP"]} -investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - All backup logs for host - Response Task"] +investigative_searches = ["ESCU - All backup logs for host - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = ["ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups"] data_models = [] providing_technologies = none @@ -748,7 +748,7 @@ version = 1 reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] detection_searches = ["ESCU - Prohibited Software On Endpoint - Rule"] mappings = {"cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "nist": ["ID.AM", "PR.DS"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -774,6 +774,22 @@ narrative = It is a common best practice to ensure that endpoints are being patc Searches in this analytic story are designed to help analysts monitor endpoints for system patches and/or updates. This helps analysts identify any systems that are not successfully updated in a timely matter.\ Microsoft releases updates for Windows systems on a monthly cadence. They should be installed as soon as possible after following internal testing and validation procedures. Patches and updates for other systems or applications are typically released as needed. +[NOBELIUM Group] +category = Adversary Tactics +creation_date = 2020-12-14 +modification_date = 2020-12-14 +id = 758196b5-2e21-424f-a50c-6e421ce926c2 +version = 2 +reference = ["https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/", "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"] +detection_searches = ["ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Sunburst Correlation DLL and Network Event - Rule", "ESCU - Supernova Webshell - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Windows AdFind Exe - Rule"] +mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 18", "CIS 2", "CIS 3", "CIS 4", "CIS 5", "CIS 6", "CIS 7", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exfiltration", "Exploitation", "Installation"], "mitre_attack": ["T1018", "T1027", "T1053.005", "T1059.003", "T1071.001", "T1071.002", "T1203", "T1218.005", "T1505.003", "T1543.003", "T1569.002"], "nist": ["DE.AE", "DE.CM", "ID.AM", "ID.RA", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]} +investigative_searches = [] +support_searches = ["ESCU - Previously Seen Running Windows Services - Update", "ESCU - Previously Seen Running Windows Services - Initial"] +data_models = ["Endpoint", "Network_Traffic", "Web"] +providing_technologies = none +description = Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around the world. +narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) of the NOBELIUM Group. The threat actor behind sunburst compromised the SolarWinds.Orion.Core.BusinessLayer.dll, is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. The detections in this Analytic Story are focusing on the dll loading events, file create events and network events to detect This malware. + [Netsh Abuse] category = Abuse creation_date = 2017-01-05 @@ -783,8 +799,8 @@ version = 1 reference = ["https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"] detection_searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule"] mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["DE.CM", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] -support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of SMB Traffic - MLTK"] data_models = ["Endpoint"] providing_technologies = none description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system. @@ -816,8 +832,8 @@ version = 2 reference = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"] detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"] mappings = {"cis20": ["CIS 2", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1059.001", "T1059.003", "T1543.003", "T1569.002"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task"] -support_searches = ["ESCU - Previously Seen Running Windows Services - Initial", "ESCU - Previously seen command line arguments", "ESCU - Previously Seen Running Windows Services - Update"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task"] +support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Previously Seen Running Windows Services - Update", "ESCU - Previously Seen Running Windows Services - Initial"] data_models = ["Endpoint"] providing_technologies = none description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry. @@ -858,7 +874,7 @@ version = 1 reference = ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"] detection_searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"] mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1059.001", "T1059.003", "T1547.001"], "nist": ["DE.AE", "DE.CM", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of Command Line Length - MLTK"] data_models = ["Endpoint"] providing_technologies = none @@ -901,7 +917,7 @@ version = 1 reference = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"] detection_searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"] mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery"], "mitre_attack": ["T1048", "T1048.003", "T1071.001", "T1189"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.DS", "PR.PT"]} -investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] support_searches = [] data_models = ["Network_Resolution", "Network_Traffic"] providing_technologies = none @@ -917,8 +933,8 @@ version = 1 reference = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] detection_searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Windows Event Log Cleared - Rule"] mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1021.002", "T1036.003", "T1047", "T1048", "T1053.005", "T1070", "T1070.001", "T1071.001", "T1485", "T1490", "T1547.001"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] -support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Baseline of Command Line Length - MLTK"] +investigative_searches = ["ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task"] +support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK"] data_models = ["Endpoint", "Network_Traffic"] providing_technologies = none description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. @@ -999,7 +1015,7 @@ version = 1 reference = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"] detection_searches = ["ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule"] mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 16", "CIS 18", "CIS 2", "CIS 3", "CIS 4", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Installation", "Reconnaissance"], "mitre_attack": ["T1021.001", "T1021.002", "T1082", "T1204.002", "T1485", "T1486", "T1490"], "nist": ["DE.AE", "DE.CM", "ID.AM", "ID.RA", "PR.AC", "PR.DS", "PR.IP", "PR.MA", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +investigative_searches = ["ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task"] support_searches = [] data_models = ["Endpoint", "Network_Traffic", "Web"] providing_technologies = none @@ -1077,7 +1093,7 @@ version = 1 reference = ["https://nvd.nist.gov/vuln/detail/CVE-2018-11409", "https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings", "https://www.exploit-db.com/exploits/44865/"] detection_searches = ["ESCU - Splunk Enterprise Information Disclosure - Rule"] mappings = {"cis20": ["CIS 18", "CIS 3", "CIS 4"], "kill_chain_phases": ["Delivery"], "nist": ["DE.CM", "ID.RA", "PR.AC", "PR.IP", "PR.PT", "RS.MI"]} -investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"] +investigative_searches = ["ESCU - Investigate Network Traffic From src ip - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = [] data_models = [] providing_technologies = none @@ -1087,22 +1103,6 @@ Splunk Enterprise exposes partial information about the host operating system, h Read more in Splunk's official response: https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings.\ A detection search within this Analytic Story looks for vulnerabilities described in CVE-2018-11409: Information Exposure (https://nvd.nist.gov/vuln/detail/CVE-2018-11409). If it turns up activities that may be specific, you can use the included investigative searches to return information regarding web activity and network traffic by src_ip. -[Sunburst Malware] -category = Adversary Tactics -creation_date = 2020-12-14 -modification_date = 2020-12-14 -id = 758196b5-2e21-424f-a50c-6e421ce926c2 -version = 1 -reference = ["https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"] -detection_searches = ["ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Sunburst Correlation DLL and Network Event - Rule", "ESCU - Supernova Webshell - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Windows AdFind Exe - Rule"] -mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 18", "CIS 2", "CIS 3", "CIS 4", "CIS 5", "CIS 6", "CIS 7", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exfiltration", "Exploitation", "Installation"], "mitre_attack": ["T1018", "T1027", "T1053.005", "T1059.003", "T1071.001", "T1071.002", "T1203", "T1505.003", "T1543.003", "T1569.002"], "nist": ["DE.AE", "DE.CM", "ID.AM", "ID.RA", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = [] -support_searches = ["ESCU - Previously Seen Running Windows Services - Initial", "ESCU - Previously Seen Running Windows Services - Update"] -data_models = ["Endpoint", "Network_Traffic", "Web"] -providing_technologies = none -description = Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around the world. -narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from the Sunburst malware. The threat actor behind sunburst compromised the SolarWinds.Orion.Core.BusinessLayer.dll, is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. The detections in this Analytic Story are focusing on the dll loading events, file create events and network events to detect This malware. - [Suspicious AWS EC2 Activities] category = Cloud Security creation_date = 2018-02-09 @@ -1112,8 +1112,8 @@ version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]} -investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task"] -support_searches = ["ESCU - Previously Seen EC2 Launches By User", "ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK", "ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Previously Seen AWS Regions"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] +support_searches = ["ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Previously Seen AWS Regions"] data_models = [] providing_technologies = none description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it. @@ -1129,7 +1129,7 @@ reference = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integr detection_searches = ["ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect new user AWS Console Login - Rule"] mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task"] -support_searches = ["ESCU - Previously seen users in CloudTrail", "ESCU - Update previously seen users in CloudTrail"] +support_searches = ["ESCU - Update previously seen users in CloudTrail", "ESCU - Previously seen users in CloudTrail"] data_models = ["Authentication"] providing_technologies = none description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. @@ -1144,7 +1144,7 @@ version = 2 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] detection_searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule"] mappings = {"cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.CM", "DE.DP", "PR.AC", "PR.DS"]} -investigative_searches = ["ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] support_searches = ["ESCU - Baseline of S3 Bucket deletion activity by ARN", "ESCU - Previously seen S3 bucket access by remote IP"] data_models = [] providing_technologies = none @@ -1162,7 +1162,7 @@ version = 1 reference = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"] detection_searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"] mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "nist": ["DE.AE", "DE.CM", "PR.AC"]} -investigative_searches = ["ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS"] data_models = [] providing_technologies = none @@ -1181,8 +1181,8 @@ version = 1 reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] detection_searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule"] mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.AE", "DE.DP", "PR.AC", "PR.DS"]} -investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] -support_searches = ["ESCU - Previously Seen AWS Cross Account Activity - Initial", "ESCU - Previously Seen Users in CloudTrail - Initial", "ESCU - Previously Seen AWS Cross Account Activity - Update", "ESCU - Previously Seen Users In CloudTrail - Update"] +investigative_searches = ["ESCU - Investigate AWS User Activities by user field - Response Task", "ESCU - Get Notable History - Response Task"] +support_searches = ["ESCU - Previously Seen AWS Cross Account Activity - Update", "ESCU - Previously Seen Users In CloudTrail - Update", "ESCU - Previously Seen AWS Cross Account Activity - Initial", "ESCU - Previously Seen Users in CloudTrail - Initial"] data_models = ["Authentication"] providing_technologies = none description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. @@ -1199,7 +1199,7 @@ reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.p detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule"] mappings = {"cis20": ["CIS 1", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.AE", "DE.DP", "ID.AM"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] -support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Instance Modifications By User - Update", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial"] +support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial", "ESCU - Previously Seen Cloud Instance Modifications By User - Update", "ESCU - Baseline Of Cloud Instances Launched"] data_models = ["Change"] providing_technologies = none description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. @@ -1215,7 +1215,7 @@ reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.p detection_searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule"] mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] -support_searches = ["ESCU - Previously Seen Cloud Provisioning Activity Sources - Update", "ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial"] +support_searches = ["ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial", "ESCU - Previously Seen Cloud Provisioning Activity Sources - Update"] data_models = ["Change"] providing_technologies = none description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. @@ -1232,7 +1232,7 @@ reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.p detection_searches = ["ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule"] mappings = {"cis20": ["CIS 1", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078", "T1078.004"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task"] -support_searches = ["ESCU - Baseline Of Cloud Infrastructure API Calls Per User", "ESCU - Previously Seen Cloud API Calls Per User Role - Update", "ESCU - Baseline Of Cloud Security Group API Calls Per User", "ESCU - Previously Seen Cloud API Calls Per User Role - Initial"] +support_searches = ["ESCU - Baseline Of Cloud Infrastructure API Calls Per User", "ESCU - Previously Seen Cloud API Calls Per User Role - Update", "ESCU - Previously Seen Cloud API Calls Per User Role - Initial", "ESCU - Baseline Of Cloud Security Group API Calls Per User"] data_models = ["Change"] providing_technologies = none description = Detect and investigate suspicious activities by users and roles in your cloud environments. @@ -1248,32 +1248,13 @@ version = 2 reference = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"] detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"] mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1036.003", "T1059.001", "T1059.003"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of Command Line Length - MLTK"] data_models = ["Endpoint"] providing_technologies = none description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems. narrative = The ability to execute arbitrary commands via the Windows CLI is a primary goal for the adversary. With access to the shell, an attacker can easily run scripts and interact with the target system. Often, attackers may only have limited access to the shell or may obtain access in unusual ways. In addition, malware may execute and interact with the CLI in ways that would be considered unusual and inconsistent with typical user activity. This provides defenders with opportunities to identify suspicious use and investigate, as appropriate. This Analytic Story contains various searches to help identify this suspicious activity, as well as others to aid you in deeper investigation. -[Suspicious Compiled HTML Activity] -category = Adversary Tactics -creation_date = 2021-02-11 -modification_date = 2021-02-11 -id = a09db4d1-3827-4833-87b8-3a397e532119 -version = 1 -reference = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://attack.mitre.org/techniques/T1218/001/", "https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa"] -detection_searches = ["ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule"] -mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["DE.CM", "PR.PT"]} -investigative_searches = [] -support_searches = [] -data_models = ["Endpoint"] -providing_technologies = none -description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. -narrative = Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. CHM content is displayed using underlying components of the Internet Explorer browser loaded by the HTML Help executable program (hh.exe). \ -HH.exe relies upon hhctrl.ocx to load CHM topics.This will load upon execution of a chm file. \ -During investigation, review all parallel processes and child processes. It is possible for file modification events to occur and it is best to capture the CHM file and decompile it for further analysis. \ -Upon usage of InfoTech Storage Handlers, ms-its, its, mk, itss.dll will load. - [Suspicious DNS Traffic] category = Adversary Tactics creation_date = 2017-09-18 @@ -1283,7 +1264,7 @@ version = 1 reference = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"] detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1048.003", "T1071.004", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = ["ESCU - Baseline of DNS Query Length - MLTK"] data_models = ["Network_Resolution"] providing_technologies = none @@ -1299,7 +1280,7 @@ version = 1 reference = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"] detection_searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"] mappings = {"cis20": ["CIS 12", "CIS 3", "CIS 7"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.AE", "PR.IP"]} -investigative_searches = ["ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Email Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = ["ESCU - DNSTwist Domain Names"] data_models = ["Email", "UEBA"] providing_technologies = none @@ -1335,7 +1316,7 @@ version = 2 reference = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/techniques/T1218/005/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5"] detection_searches = ["ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule"] mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1059.003", "T1218.005", "T1547.001"], "nist": ["DE.AE", "DE.CM", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of Command Line Length - MLTK"] data_models = ["Endpoint"] providing_technologies = none @@ -1363,7 +1344,7 @@ version = 1 reference = ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"] detection_searches = ["ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule"] mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} -investigative_searches = ["ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task", "ESCU - Investigate Okta Activity by IP Address - Response Task"] +investigative_searches = ["ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate User Activities In Okta - Response Task", "ESCU - Investigate Okta Activity by app - Response Task"] support_searches = [] data_models = [] providing_technologies = none @@ -1372,22 +1353,6 @@ narrative = Okta is the leading single sign on (SSO) provider, allowing users to While SSO is a major convenience for users, it also provides attackers with an opportunity. If the attacker can gain access to Okta, they can access a variety of applications. As such monitoring the environment is important. \ With people moving quickly to adopt web-based applications and ways to manage them, many are still struggling to understand how best to monitor these environments. This analytic story provides searches to help monitor this environment, and identify events and activity that warrant further investigation such as credential stuffing or password spraying attacks, and users logging in from multiple locations when travel is disallowed. -[Suspicious Regsvcs Regasm Activity] -category = Adversary Tactics -creation_date = 2021-02-11 -modification_date = 2021-02-11 -id = 2cdf33a0-4805-4b61-b025-59c20f418fbe -version = 1 -reference = ["https://attack.mitre.org/techniques/T1218/009/", "https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/evasion/windows/applocker_evasion_regasm_regsvcs.md", "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/"] -detection_searches = ["ESCU - Detect Regasm Spawning a Process - Rule", "ESCU - Detect Regasm with Network Connection - Rule", "ESCU - Detect Regasm with no Command Line Arguments - Rule", "ESCU - Detect Regsvcs Spawning a Process - Rule", "ESCU - Detect Regsvcs with Network Connection - Rule", "ESCU - Detect Regsvcs with No Command Line Arguments - Rule"] -mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["DE.CM", "PR.PT"]} -investigative_searches = [] -support_searches = [] -data_models = ["Endpoint"] -providing_technologies = none -description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. -narrative = Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. The following queries assist with detecting suspicious and malicious usage of Regasm.exe and Regsvcs.exe. Upon reviewing usage of Regasm.exe Regsvcs.exe, review file modification events for possible script code written. Review parallel process events for csc.exe being utilized to compile script code. - [Suspicious Regsvr32 Activity] category = Adversary Tactics creation_date = 2021-01-29 @@ -1429,7 +1394,7 @@ version = 2 reference = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"] detection_searches = ["ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule"] mappings = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047", "T1546.003"], "nist": ["PR.AC", "PR.AT", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -1447,7 +1412,7 @@ version = 1 reference = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"] detection_searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule"] mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.001", "T1546.011", "T1546.012", "T1547.001", "T1547.010", "T1548.002", "T1564.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -1466,7 +1431,7 @@ reference = ["https://blog.rapid7.com/2020/04/02/dispelling-zoom-bugbears-what-y detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Child Process of Zoom - Rule"] mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1059.003", "T1068"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Process File Activity - Response Task"] -support_searches = ["ESCU - Previously Seen Zoom Child Processes - Update", "ESCU - Previously Seen Zoom Child Processes - Initial"] +support_searches = ["ESCU - Previously Seen Zoom Child Processes - Initial", "ESCU - Previously Seen Zoom Child Processes - Update"] data_models = ["Endpoint"] providing_technologies = none description = Attackers are using Zoom as an vector to increase privileges on a sytems. This story detects new child processes of zoom and provides investigative actions for this detection. @@ -1528,7 +1493,7 @@ version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] detection_searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule"] mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} -investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = ["ESCU - Previously Seen EC2 Modifications By User"] data_models = [] providing_technologies = none @@ -1545,7 +1510,7 @@ version = 2 reference = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"] detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"] mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1016", "T1036.003", "T1204.002", "T1218.011"], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = ["ESCU - Baseline of Command Line Length - MLTK"] data_models = ["Endpoint"] providing_technologies = none @@ -1563,7 +1528,7 @@ version = 1 reference = ["https://www.monkey.org/~dugsong/dsniff/"] detection_searches = ["ESCU - Protocols passing authentication in cleartext - Rule"] mappings = {"cis20": ["CIS 14", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Reconnaissance"], "nist": ["DE.AE", "PR.AC", "PR.DS", "PR.PT"]} -investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +investigative_searches = ["ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = [] data_models = ["Network_Traffic"] providing_technologies = none @@ -1579,7 +1544,7 @@ version = 1 reference = ["https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud", "https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718"] detection_searches = ["ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Password Sharing Across Accounts - Rule"] mappings = {"cis20": ["CIS 16", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078", "T1136"], "nist": ["DE.AE", "DE.CM", "DE.DP"]} -investigative_searches = ["ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Web Session Information via session id - Response Task"] +investigative_searches = ["ESCU - Get Web Session Information via session id - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = [] data_models = [] providing_technologies = none @@ -1616,7 +1581,7 @@ version = 1 reference = ["https://attack.mitre.org/wiki/Defense_Evasion"] detection_searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"] mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1222.001", "T1548.002", "T1562.001", "T1564.001"], "nist": ["DE.CM", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -1632,7 +1597,7 @@ version = 1 reference = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"] detection_searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Suspicious Changes to File Associations - Rule"] mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003", "T1546.001"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -1652,7 +1617,7 @@ version = 2 reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"] detection_searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule"] mappings = {"cis20": ["CIS 10", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.001", "T1490"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -1669,7 +1634,7 @@ version = 2 reference = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"] detection_searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule"] mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation", "Privilege Escalation"], "mitre_attack": ["T1053.005", "T1222.001", "T1543.003", "T1546.011", "T1547.001", "T1547.010", "T1564.001", "T1574.009", "T1574.011"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -1685,7 +1650,7 @@ version = 2 reference = ["https://attack.mitre.org/tactics/TA0004/"] detection_searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule"] mappings = {"cis20": ["CIS 2", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1068", "T1204.002", "T1546.008", "T1546.012"], "nist": ["DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = [] data_models = ["Endpoint"] providing_technologies = none @@ -1701,8 +1666,8 @@ version = 3 reference = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"] detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"] mappings = {"cis20": ["CIS 2", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1543.003", "T1569.002", "T1574.011"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] -support_searches = ["ESCU - Previously Seen Running Windows Services - Initial", "ESCU - Previously Seen Running Windows Services - Update"] +investigative_searches = ["ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +support_searches = ["ESCU - Previously Seen Running Windows Services - Update", "ESCU - Previously Seen Running Windows Services - Initial"] data_models = ["Endpoint"] providing_technologies = none description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner. diff --git a/package/default/analyticstories.conf b/package/default/analyticstories.conf index 77f8a285d7..d40b3ba8df 100644 --- a/package/default/analyticstories.conf +++ b/package/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-03-04T19:43:30 UTC +# On Date: 2021-03-12T17:19:06 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -14,7 +14,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect role creation - Rule", "ESCU - aws detect sts get session token abuse - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - aws detect sts get session token abuse - Rule", "ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect role creation - Rule", "ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"] description = Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. narrative = Amazon Web Services (AWS) admins manage access to AWS resources and services across the enterprise using AWS's Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage AWS users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as EC2 instances, the AWS Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\ Herein lies the rub. In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\ @@ -27,7 +27,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS). It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \ @@ -41,7 +41,7 @@ version = 2 references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls. @@ -52,7 +52,7 @@ version = 1 references = ["https://aws.amazon.com/security-hub/features/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] description = This story is focused around detecting Security Hub alerts generated from AWS narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager. @@ -63,7 +63,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Get All AWS Activity From Region - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Get All AWS Activity From Region - Response Task", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network. narrative = Because most enterprise AWS activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary. \ This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further. @@ -75,7 +75,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect new API calls from user roles - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] +searches = ["ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task", "ESCU - Get Notable History - Response Task"] description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new EC2 instances and increased bandwidth usage. \ @@ -89,7 +89,7 @@ version = 1 references = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Suspicious Java Classes - Rule", "ESCU - Investigate Web POSTs From src - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task"] +searches = ["ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Investigate Web POSTs From src - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Get Notable History - Response Task"] description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities. narrative = In March of 2017, a remote code-execution vulnerability in the Jakarta Multipart parser in Apache Struts, a widely used open-source framework for creating Java web applications, was disclosed and assigned to CVE-2017-5638. About two months later, hackers exploited the flaw to carry out the world's 5th largest data breach. The target, credit giant Equifax, told investigators that it had become aware of the vulnerability two months before the attack. \ The exploit involved manipulating the `Content-Type HTTP` header to execute commands embedded in the header.\ @@ -113,7 +113,7 @@ version = 1 references = ["https://www.cisecurity.org/controls/inventory-of-authorized-and-unauthorized-devices/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Response Task"] +searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Response Task", "ESCU - Get Notable History - Response Task"] description = Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further. narrative = This Analytic Story is designed to help you develop a better understanding of what authorized and unauthorized devices are part of your enterprise. This story can help you better categorize and classify assets, providing critical business context and awareness of their assets during an incident. Information derived from this Analytic Story can be used to better inform and support other analytic stories. For successful detection, you will need to leverage the Assets and Identity Framework from Enterprise Security to populate your known assets. @@ -124,7 +124,7 @@ version = 1 references = ["https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect Baron Samedit CVE-2021-3156 Segfault - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 via OSQuery - Rule"] +searches = ["ESCU - Detect Baron Samedit CVE-2021-3156 - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 Segfault - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 via OSQuery - Rule"] description = Uncover activity consistent with CVE-2021-3156. Discovered by the Qualys Research Team, this vulnerability has been found to affect sudo across multiple Linux distributions (Ubuntu 20.04 and prior, Debian 10 and prior, Fedora 33 and prior). As this vulnerability was committed to code in July 2011, there will be many distributions affected. Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host. narrative = A non-privledged user is able to execute the sudoedit command to trigger a buffer overflow. After the successful buffer overflow, they are then able to gain root privileges on the affected host. The conditions needed to be run are a trailing "\" along with shell and edit flags. Monitoring the /var/log directory on Linux hosts using the Splunk Universal Forwarder will allow you to pick up this behavior when using the provided detection. @@ -135,7 +135,7 @@ version = 1 references = ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Email Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task"] description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name. narrative = While you can educate your users and customers about the risks and threats posed by typosquatting, phishing, and corporate espionage, human error is a persistent fact of life. Of course, your adversaries are all too aware of this reality and will happily leverage it for nefarious purposes whenever possible3phishing with lookalike addresses, embedding faux command-and-control domains in malware, and hosting malicious content on domains that closely mimic your corporate servers. This is where brand monitoring comes in.\ You can use our adaptation of `DNSTwist`, together with the support searches in this Analytic Story, to generate permutations of specified brands and external domains. Splunk can monitor email, DNS requests, and web traffic for these permutations and provide you with early warnings and situational awareness--powerful elements of an effective defense.\ @@ -148,7 +148,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Get Notable History - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \ @@ -162,7 +162,7 @@ version = 1 references = ["https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps", "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf", "https://us-cert.cisa.gov/ncas/alerts/aa21-008a"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - O365 Added Service Principal - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - AWS SAML Access by Provider User and Principal - Rule"] +searches = ["ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - AWS SAML Update identity provider - Rule"] description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements. narrative = This story is composed of detection searches based on endpoint that addresses the use of Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) related events are also addressed in specific cloud environment detection searches. @@ -173,7 +173,7 @@ version = 1 references = ["https://www.cobaltstrike.com/", "https://www.infocyte.com/blog/2020/09/02/cobalt-strike-the-new-favorite-among-thieves/", "https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/", "https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html", "https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html", "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence", "https://github.com/zer0yu/Awesome-CobaltStrike"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Suspicious msbuild path - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule"] +searches = ["ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule"] description = Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility. narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Cobalt Strike. Cobalt Strike has many ways to be enhanced by using aggressor scripts, malleable C2 profiles, default attack packages, and much more. For endpoint behavior, Cobalt Strike is most commonly identified via named pipes, spawn to processes, and DLL function names. Many additional variables are provided for in memory operation of the beacon implant. On the network, depending on the malleable C2 profile used, it is near infinite in the amount of ways to conceal the C2 traffic with Cobalt Strike. Not every query may be specific to Cobalt Strike the tool, but the methodologies and techniques used by it.\ Splunk Threat Research reviewed all publicly available instances of Malleabe C2 Profiles and generated a list of the most commonly used spawnto and pipenames.\ @@ -193,7 +193,7 @@ version = 1 references = ["https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/", "https://objective-see.com/blog/blog_0x2A.html", "https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jose Hernandez"}] spec_version = 3 -searches = ["ESCU - Processes Tapping Keyboard Events - Rule", "ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"] +searches = ["ESCU - Processes Tapping Keyboard Events - Rule", "ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Investigate Network Traffic From src ip - Response Task", "ESCU - Get Notable History - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more. narrative = Conventional wisdom holds that Apple's MacOS operating system is significantly less vulnerable to attack than Windows machines. While that point is debatable, it is true that attacks against MacOS systems are much less common. However, this fact does not mean that Macs are impervious to breaches. To the contrary, research has shown that that Mac malware is increasing at an alarming rate. According to AV-test, in 2018, there were 86,865 new MacOS malware variants, up from 27,338 the year before—a 31% increase. In contrast, the independent research firm found that new Windows malware had increased from 65.17M to 76.86M during that same period, less than half the rate of growth. The bottom line is that while the numbers look a lot smaller than Windows, it's definitely time to take Mac security more seriously.\ This Analytic Story addresses the ColdRoot remote access trojan (RAT), which was uploaded to Github in 2016, but was still escaping detection by the first quarter of 2018, when a new, more feature-rich variant was discovered masquerading as an Apple audio driver. Among other capabilities, the Pascal-based ColdRoot can heist passwords from users' keychains and remotely control infected machines without detection. In the initial report of his findings, Patrick Wardle, Chief Research Officer for Digita Security, explained that the new ColdRoot RAT could start and kill processes on the breached system, spawn new remote-desktop sessions, take screen captures and assemble them into a live stream of the victim's desktop, and more.\ @@ -206,7 +206,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. narrative = A common adversary goal is to identify and exfiltrate data of value from a target organization. This data may include email conversations and addresses, confidential company information, links to network design/infrastructure, important dates, and so on.\ Attacks are composed of three activities: identification, collection, and staging data for exfiltration. Identification typically involves scanning systems and observing user activity. Collection can involve the transfer of large amounts of data from various repositories. Staging/preparation includes moving data to a central location and compressing (and optionally encoding and/or encrypting) it. All of these activities provide opportunities for defenders to identify their presence. \ @@ -219,7 +219,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Protocol or Port Mismatch - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators. narrative = Threat actors typically architect and implement an infrastructure to use in various ways during the course of their attack campaigns. In some cases, they leverage this infrastructure for scanning and performing reconnaissance activities. In others, they may use this infrastructure to launch actual attacks. One of the most important functions of this infrastructure is to establish servers that will communicate with implants on compromised endpoints. These servers establish a command and control channel that is used to proxy data between the compromised endpoint and the attacker. These channels relay commands from the attacker to the compromised endpoint and the output of those commands back to the attacker.\ Because this communication is so critical for an adversary, they often use techniques designed to hide the true nature of the communications. There are many different techniques used to establish and communicate over these channels. This Analytic Story provides searches that look for a variety of the techniques used for these channels, as well as indications that these channels are active, by examining logs associated with border control devices and network-access control lists. @@ -231,7 +231,7 @@ version = 1 references = ["https://github.com/kgretzky/evilginx2", "https://attack.mitre.org/techniques/T1192/", "https://breakdev.org/evilginx-advanced-phishing-with-two-factor-authentication-bypass/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Splunk Research Team"}] spec_version = 3 -searches = ["ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule", "ESCU - Domain Certificate Investigation - Response Task", "ESCU - Get Certificate logs for a domain - Response Task"] +searches = ["ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule", "ESCU - Get Certificate logs for a domain - Response Task", "ESCU - Domain Certificate Investigation - Response Task"] description = Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email. narrative = As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Because phishing is a technique that relies on human psychology, you will never be able to eliminate this vulnerability 100%. But you can use automated detection to significantly reduce the risks.\ This Analytic Story focuses on detecting signs of MiTM attacks enabled by [EvilGinx2](https://github.com/kgretzky/evilginx2), a toolkit that sets up a transparent proxy between the targeted site and the user. In this way, the attacker is able to intercept credentials and two-factor identification tokens. It employs a proxy template to allow a registered domain to impersonate targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit, Office 365, and others. It can even register SSL certificates and camouflage them via a URL shortener, making them difficult to detect. Searches in this story look for signs of MiTM attacks enabled by EvilGinx2. @@ -254,7 +254,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task"] +searches = ["ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Previous Unseen User - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task"] description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. narrative = Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\ @@ -267,7 +267,7 @@ version = 2 references = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Create local admin accounts using net exe - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more. narrative = The frequency of nation-state cyber attacks has increased significantly over the last decade. Employing numerous tactics and techniques, these attacks continue to escalate in complexity. \ There is a wide range of motivations for these state-sponsored hacks, including stealing valuable corporate, military, or diplomatic dataѿall of which could confer advantages in various arenas. They may also target critical infrastructure. \ @@ -293,7 +293,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - DNS record changed - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - DNS Hijack Enrichment - Response Task"] +searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - DNS Hijack Enrichment - Response Task"] description = Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records. narrative = Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. One reason is its distributed nature. It relies on unstructured connections between millions of clients and servers over inherently insecure protocols.\ The gravity and extent of the importance of securing DNS from attacks is undeniable. The fallout of compromised DNS can be disastrous. Not only can hackers bring down an entire business, they can intercept confidential information, emails, and login credentials, as well. \ @@ -323,7 +323,7 @@ version = 1 references = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration. narrative = Attackers can leverage a variety of resources to compromise or exfiltrate enterprise data. Common exfiltration techniques include remote-access channels via low-risk, high-payoff active-collections operations and close-access operations using insiders and removable media. While this Analytic Story is not a comprehensive listing of all the methods by which attackers can exfiltrate data, it provides a useful starting point. @@ -334,7 +334,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://github.com/SecuraBV/CVE-2020-1472", "https://www.secura.com/blog/zero-logon", "https://nvd.nist.gov/vuln/detail/CVE-2020-1472"] maintainers = [{"company": "Jose Hernandez, Stan Miskowicz, David Dorsey, Shannon Davis Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Get Notable History - Response Task"] description = Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein attackers target a Microsoft Windows Domain Controller to reset its computer account password. The result from this attack is attackers can now provide themselves high privileges and take over Domain Controller. The included searches in this Analytic Story are designed to identify attempts to reset Domain Controller Computer Account via exploit code remotely or via the use of tool Mimikatz as payload carrier. narrative = This attack is a privilege escalation technique, where attacker targets a Netlogon secure channel connection to a domain controller, using Netlogon Remote Protocol (MS-NRPC). This vulnerability exposes vulnerable Windows Domain Controllers to be targeted via unaunthenticated RPC calls which eventually reset Domain Contoller computer account ($) providing the attacker the opportunity to exfil domain controller credential secrets and assign themselve high privileges that can lead to domain controller and potentially complete network takeover. The detection searches in this Analytic Story use Windows Event viewer events and Sysmon events to detect attack execution, these searches monitor access to the Local Security Authority Subsystem Service (LSASS) process which is an indicator of the use of Mimikatz tool which has bee updated to carry this attack payload. @@ -345,7 +345,7 @@ version = 2 references = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Unload Sysmon Filter Driver - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Unload Sysmon Filter Driver - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others. narrative = Attackers employ a variety of tactics in order to avoid detection and operate without barriers. This often involves modifying the configuration of security tools to get around them or explicitly disabling them to prevent them from running. This Analytic Story includes searches that look for activity consistent with attackers attempting to disable various security mechanisms. Such activity may involve monitoring for suspicious registry activity, as this is where much of the configuration for Windows and various other programs reside, or explicitly attempting to shut down security-related services. Other times, attackers attempt various tricks to prevent specific programs from running, such as adding the certificates with which the security tools are signed to a block list (which would prevent them from running). @@ -367,7 +367,7 @@ version = 1 references = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task"] description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment. narrative = The trojan downloader known as Emotet first surfaced in 2014, when it was discovered targeting the banking industry to steal credentials. However, according to a joint technical alert (TA) issued by three government agencies (https://www.us-cert.gov/ncas/alerts/TA18-201A), Emotet has evolved far beyond those beginnings to become what a ThreatPost article called a threat-delivery service(see https://threatpost.com/emotet-malware-evolves-beyond-banking-to-threat-delivery-service/134342/). For example, in early 2018, Emotet was found to be using its loader function to spread the Quakbot and Ransomware variants. \ According to the TA, the the malware continues to be among the most costly and destructive malware affecting the private and public sectors. Researchers have linked it to the threat group Mealybug, which has also been on the security communitys radar since 2014.\ @@ -391,7 +391,7 @@ version = 1 references = ["https://cloud.google.com/iam/docs/understanding-service-accounts"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - gcp detect oauth token abuse - Rule", "ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - gcp detect oauth token abuse - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - Get Notable History - Response Task"] description = Track when a user assumes an IAM role in another GCP account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. narrative = Google Cloud Platform (GCP) admins manage access to GCP resources and services across the enterprise using GCP Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage GCP users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as Compute instances, the GCP Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are potentially assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\ In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\ @@ -404,7 +404,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html", "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/", "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/", "https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Nishang PowershellTCPOneLine - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule"] +searches = ["ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Detect Exchange Web Shell - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Nishang PowershellTCPOneLine - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - W3WP Spawning Shell - Rule"] description = HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVEs in the wild - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065. narrative = On Tuesday, March 2, 2021, Microsoft released a set of security patches for its mail server, Microsoft Exchange. These patches respond to a group of vulnerabilities known to impact Exchange 2013, 2016, and 2019. It is important to note that an Exchange 2010 security update has also been issued, though the CVEs do not reference that version as being vulnerable.\ While the CVEs do not shed much light on the specifics of the vulnerabilities or exploits, the first vulnerability (CVE-2021-26855) has a remote network attack vector that allows the attacker, a group Microsoft named HAFNIUM, to authenticate as the Exchange server. Three additional vulnerabilities (CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) were also identified as part of this activity. When chained together along with CVE-2021-26855 for initial access, the attacker would have complete control over the Exchange server. This includes the ability to run code as SYSTEM and write to any path on the server.\ @@ -417,7 +417,7 @@ version = 2 references = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Create or delete windows shares using net exe - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Create or delete windows shares using net exe - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A. narrative = North Korea's government-sponsored "cyber army" has been slowly building momentum and gaining sophistication over the last 15 years or so. As a result, the group's activity, which the US government refers to as "Hidden Cobra," has surreptitiously crept onto the collective radar as a preeminent global threat.\ These state-sponsored actors are thought to be responsible for everything from a hack on a South Korean nuclear plant to an attack on Sony in anticipation of its release of the movie "The Interview" at the end of 2014. They're also notorious for cyberespionage. In recent years, the group seems to be focused on financial crimes, such as cryptojacking.\ @@ -431,7 +431,7 @@ version = 1 references = ["https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-hijacks/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Windows hosts file modification - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Windows hosts file modification - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task"] description = Detect evidence of tactics used to redirect traffic from a host to a destination other than the one intended--potentially one that is part of an adversary's attack infrastructure. An example is redirecting communications regarding patches and updates or misleading users into visiting a malicious website. narrative = Attackers will often attempt to manipulate client communications for nefarious purposes. In some cases, an attacker may endeavor to modify a local host file to redirect communications with resources (such as antivirus or system-update services) to prevent clients from receiving patches or updates. In other cases, an attacker might use this tactic to have the client connect to a site that looks like the intended site, but instead installs malware or collects information from the victim. Additionally, an attacker may redirect a victim in order to execute a MITM attack and observe communications. @@ -467,7 +467,7 @@ version = 1 references = ["https://github.com/splunk/cloud-datamodel-security-research"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task"] +searches = ["ESCU - Kubernetes Azure scan fingerprint - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"] description = This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitve information and management priviledges of production workloads, microservices and applications. These searches allow operator to detect suspicious unauthenticated requests from the internet to kubernetes cluster. @@ -478,7 +478,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule", "ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Get Notable History - Response Task"] description = This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive objects within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes sensitive objects. @@ -489,7 +489,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule", "ESCU - Kubernetes GCP detect sensitive role access - Rule", "ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule", "ESCU - Kubernetes AWS detect most active service accounts by pod - Rule", "ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule", "ESCU - Kubernetes GCP detect most active service accounts by pod - Rule", "ESCU - Kubernetes AWS detect RBAC authorization by account - Rule", "ESCU - Kubernetes AWS detect sensitive role access - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Kubernetes GCP detect sensitive role access - Rule", "ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes AWS detect sensitive role access - Rule", "ESCU - Kubernetes AWS detect RBAC authorization by account - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule", "ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule", "ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule", "ESCU - Kubernetes AWS detect most active service accounts by pod - Rule", "ESCU - Kubernetes GCP detect most active service accounts by pod - Rule", "ESCU - Get Notable History - Response Task"] description = This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive roles within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes role activities @@ -500,7 +500,7 @@ version = 2 references = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task"] description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts. narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\ Indications of lateral movement can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash, or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or "crown jewels" to a persistent threat actor.\ @@ -515,7 +515,7 @@ version = 4 references = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Any Powershell DownloadFile - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task"] description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent. narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope.\ The following factors may assist you in determining whether the event is malicious: \ @@ -535,7 +535,7 @@ version = 1 references = ["https://www.carbonblack.com/2016/03/04/tracking-locky-ransomware-using-carbon-black/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Unsuccessful Netbackup backups - Rule", "ESCU - Extended Period Without Successful Netbackup Backups - Rule", "ESCU - Get Notable History - Response Task", "ESCU - All backup logs for host - Response Task"] +searches = ["ESCU - Extended Period Without Successful Netbackup Backups - Rule", "ESCU - Unsuccessful Netbackup backups - Rule", "ESCU - All backup logs for host - Response Task", "ESCU - Get Notable History - Response Task"] description = Address common concerns when monitoring your backup processes. These searches can help you reduce risks from ransomware, device theft, or denial of physical access to a host by backing up data on endpoints. narrative = Having backups is a standard best practice that helps ensure continuity of business operations. Having mature backup processes can also help you reduce the risks of many security-related incidents and streamline your response processes. The detection searches in this Analytic Story will help you identify systems that have backup failures, as well as systems that have not been backed up for an extended period of time. The story will also return the notable event history and all of the backup logs for an endpoint. @@ -546,7 +546,7 @@ version = 1 references = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment. narrative = It is critical to identify unauthorized software and processes running on enterprise endpoints and determine whether they are likely to be malicious. This Analytic Story requires the user to populate the Interesting Processes table within Enterprise Security with prohibited processes. An included support search will augment this data, adding information on processes thought to be malicious. This search requires data from endpoint detection-and-response solutions, endpoint data sources (such as Sysmon), or Windows Event Logs--assuming that the Active Directory administrator has enabled process tracking within the System Event Audit Logs.\ It is important to investigate any software identified as suspicious, in order to understand how it was installed or executed. Analyzing authentication logs or any historic notable events might elicit additional investigative leads of interest. For best results, schedule the search to run every two weeks. @@ -564,6 +564,17 @@ narrative = It is a common best practice to ensure that endpoints are being patc Searches in this analytic story are designed to help analysts monitor endpoints for system patches and/or updates. This helps analysts identify any systems that are not successfully updated in a timely matter.\ Microsoft releases updates for Windows systems on a monthly cadence. They should be installed as soon as possible after following internal testing and validation procedures. Patches and updates for other systems or applications are typically released as needed. +[analytic_story://NOBELIUM Group] +category = Adversary Tactics +last_updated = 2020-12-14 +version = 2 +references = ["https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/", "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"] +maintainers = [{"company": "Michael Haag, Splunk", "email": "-", "name": "Patrick Bareiss"}] +spec_version = 3 +searches = ["ESCU - Supernova Webshell - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Sunburst Correlation DLL and Network Event - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Windows AdFind Exe - Rule", "ESCU - TOR Traffic - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Schtasks scheduling job on remote system - Rule"] +description = Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around the world. +narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) of the NOBELIUM Group. The threat actor behind sunburst compromised the SolarWinds.Orion.Core.BusinessLayer.dll, is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. The detections in this Analytic Story are focusing on the dll loading events, file create events and network events to detect This malware. + [analytic_story://Netsh Abuse] category = Abuse last_updated = 2017-01-05 @@ -571,7 +582,7 @@ version = 1 references = ["https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Processes launching netsh - Rule", "ESCU - Processes created by netsh - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system. narrative = It is a common practice for attackers of all types to leverage native Windows tools and functionality to execute commands for malicious reasons. One such tool on Windows OS is `netsh.exe`,a command-line scripting utility that allows you to--either locally or remotely--display or modify the network configuration of a computer that is currently running. `Netsh.exe` can be used to discover and disable local firewall settings. It can also be used to set up a remote connection to a host from an infected system.\ To get started, run the detection search to identify parent processes of `netsh.exe`. @@ -583,7 +594,7 @@ version = 1 references = ["https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}] spec_version = 3 -searches = ["ESCU - O365 Added Service Principal - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - High Number of Login Failures from a single source - Rule"] +searches = ["ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - High Number of Login Failures from a single source - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule"] description = This story is focused around detecting Office 365 Attacks. narrative = More and more companies are using Microsofts Office 365 cloud offering. Therefore, we see more and more attacks against Office 365. This story provides various detections for Office 365 attacks. @@ -594,7 +605,7 @@ version = 2 references = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task"] description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry. narrative = In May of 2018, the attack group Orangeworm was implicated for installing a custom backdoor called Trojan.Kwampirs within large international healthcare corporations in the United States, Europe, and Asia. This malware provides the attackers with remote access to the target system, decrypting and extracting a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.\ Awareness of the Orangeworm group first surfaced in January, 2015. It has conducted targeted attacks against related industries, as well, such as pharmaceuticals and healthcare IT solution providers.\ @@ -608,7 +619,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Splunk Research Team"}] spec_version = 3 -searches = ["ESCU - Detect Oulook exe writing a zip file - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Get Parent Process Info - Response Task"] +searches = ["ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Detect Oulook exe writing a zip file - Rule", "ESCU - Get Parent Process Info - Response Task"] description = Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack. narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as [91% of all successful attacks](https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \ As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely "automate" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. \ @@ -626,7 +637,7 @@ version = 1 references = ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"] maintainers = [{"company": "iDefense", "email": "-", "name": "iDefense Cyber Espionage Team"}] spec_version = 3 -searches = ["ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task"] description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group. narrative = This story was created as a joint effort between iDefense and Splunk.\ iDefense analysts have recently discovered a Windows executable file that, upon execution, spoofs a decryption tool and then drops a file that appears to be the custom-built javascript backdoor, "Orz," which is associated with the threat actors known as MUDCARP (as well as "temp.Periscope" and "Leviathan"). The file is executed using Wscript.\ @@ -664,7 +675,7 @@ version = 1 references = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers. narrative = A traditional security best practice is to control the ports, protocols, and services allowed within your environment. By limiting the services and protocols to those explicitly approved by policy, administrators can minimize the attack surface. The combined effect allows both network defenders and security controls to focus and not be mired in superfluous traffic or data types. Looking for deviations to policy can identify attacker activity that abuses services and protocols to run on alternate or non-standard ports in the attempt to avoid detection or frustrate forensic analysts. @@ -675,7 +686,7 @@ version = 1 references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - TOR Traffic - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. @@ -697,7 +708,7 @@ version = 1 references = ["https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html", "https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Port Security Violation - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Get Notable History - Response Task"] description = Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers. narrative = Networking devices, such as routers and switches, are often overlooked as resources that attackers will leverage to subvert an enterprise. Advanced threats actors have shown a proclivity to target these critical assets as a means to siphon and redirect network traffic, flash backdoored operating systems, and implement cryptographic weakened algorithms to more easily decrypt network traffic.\ This Analytic Story helps you gain a better understanding of how your network devices are interacting with your hosts. By compromising your network devices, attackers can obtain direct access to the company's internal infrastructure— effectively increasing the attack surface and accessing private services/data. @@ -709,7 +720,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/detecting-ryuk-using-splunk-attack-range.html", "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jose Hernandez"}] spec_version = 3 -searches = ["ESCU - Common Ransomware Notes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Windows connhost exe started forcefully - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Spike in File Writes - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Windows connhost exe started forcefully - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Get Notable History - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Ryuk ransomware, including looking for file writes associated with Ryuk, Stopping Security Access Manager, DisableAntiSpyware registry key modification, suspicious psexec use, and more. narrative = Cybersecurity Infrastructure Security Agency (CISA) released Alert (AA20-302A) on October 28th called “Ransomware Activity Targeting the Healthcare and Public Health Sector.” This alert details TTPs associated with ongoing and possible imminent attacks against the Healthcare sector, and is a joint advisory in coordination with other U.S. Government agencies. The objective of these malicious campaigns is to infiltrate targets in named sectors and to drop ransomware payloads, which will likely cause disruption of service and increase risk of actual harm to the health and safety of patients at hospitals, even with the aggravant of an ongoing COVID-19 pandemic. This document specifically refers to several crimeware exploitation frameworks, emphasizing the use of Ryuk ransomware as payload. The Ryuk ransomware payload is not new. It has been well documented and identified in multiple variants. Payloads need a carrier, and for Ryuk it has often been exploitation frameworks such as Cobalt Strike, or popular crimeware frameworks such as Emotet or Trickbot. @@ -732,7 +743,7 @@ version = 1 references = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Common Ransomware Notes - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Spike in File Writes - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more. narrative = The first version of the SamSam ransomware (a.k.a. Samas or SamsamCrypt) was launched in 2015 by a group of Iranian threat actors. The malicious software has affected and continues to affect thousands of victims and has raised almost $6M in ransom.\ Although categorized under the heading of ransomware, SamSam campaigns have some importance distinguishing characteristics. Most notable is the fact that conventional ransomware is a numbers game. Perpetrators use a "spray-and-pray" approach with phishing campaigns or other mechanisms, charging a small ransom (typically under $1,000). The goal is to find a large number of victims willing to pay these mini-ransoms, adding up to a lucrative payday. They use relatively simple methods for infecting systems.\ @@ -748,7 +759,7 @@ version = 1 references = ["https://redcanary.com/blog/clipping-silver-sparrows-wings/", "https://www.sentinelone.com/blog/5-things-you-need-to-know-about-silver-sparrow/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Suspicious PlistBuddy Usage via OSquery - Rule", "ESCU - Suspicious SQLite3 LSQuarantine Behavior - Rule", "ESCU - Suspicious PlistBuddy Usage - Rule", "ESCU - Suspicious Curl Network Connection - Rule"] +searches = ["ESCU - Suspicious Curl Network Connection - Rule", "ESCU - Suspicious PlistBuddy Usage - Rule", "ESCU - Suspicious PlistBuddy Usage via OSquery - Rule", "ESCU - Suspicious SQLite3 LSQuarantine Behavior - Rule"] description = Silver Sparrow, identified by Red Canary Intelligence, is a new forward looking MacOS (Intel and M1) malicious software downloader utilizing JavaScript for execution and a launchAgent to establish persistence. narrative = Silver Sparrow works is a dropper and uses typical persistence mechanisms on a Mac. It is cross platform, covering both Intel and Apple M1 architecture. To this date, no implant has been downloaded for malicious purposes. During installation of the update.pkg or updater.pkg file, the malicious software utilizes JavaScript to generate files and scripts on disk for persistence.These files later download a implant from an S3 bucket every hour. This analytic assists with identifying different types of macOS malware families establishing LaunchAgent persistence. Per SentinelOne source, it is predicted that Silver Sparrow is likely selling itself as a mechanism to 3rd party “affiliates” or pay-per-install (PPI) partners, typically seen as commodity adware/malware. Additional indicators and behaviors may be found within the references. @@ -790,24 +801,13 @@ version = 1 references = ["https://nvd.nist.gov/vuln/detail/CVE-2018-11409", "https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings", "https://www.exploit-db.com/exploits/44865/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"] +searches = ["ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Investigate Network Traffic From src ip - Response Task", "ESCU - Get Notable History - Response Task"] description = Reduce the risk of CVE-2018-11409, an information disclosure vulnerability within some older versions of Splunk Enterprise, with searches designed to help ensure that your Splunk system does not leak information to authenticated users. narrative = Although there have been no reports of it being exploited, Splunk Enterprise versions through 7.0.1 reportedly have a vulnerability that may expose information through a REST endpoint (read more here: https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings). NIST has included it in its vulnerability database (read more here: https://nvd.nist.gov/vuln/detail/CVE-2018-11409). The REST endpoint that exposes system information is also necessary for the proper operation of Splunk clustering and instrumentation. Customers should upgrade to the latest version to reduce the risk of this vulnerability.\ Splunk Enterprise exposes partial information about the host operating system, hardware, and Splunk license. Splunk Enterprise before 6.6.0 exposes this information without authentication. Splunk Enterprise 6.6.0 and later exposes this information only to authenticated Splunk users. Based on the information exposure, Splunk characterizes this issue as a low severity impact.\ Read more in Splunk's official response: https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings.\ A detection search within this Analytic Story looks for vulnerabilities described in CVE-2018-11409: Information Exposure (https://nvd.nist.gov/vuln/detail/CVE-2018-11409). If it turns up activities that may be specific, you can use the included investigative searches to return information regarding web activity and network traffic by src_ip. -[analytic_story://Sunburst Malware] -category = Adversary Tactics -last_updated = 2020-12-14 -version = 1 -references = ["https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"] -maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}] -spec_version = 3 -searches = ["ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Sunburst Correlation DLL and Network Event - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Supernova Webshell - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Windows AdFind Exe - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Detect Outbound SMB Traffic - Rule"] -description = Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around the world. -narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from the Sunburst malware. The threat actor behind sunburst compromised the SolarWinds.Orion.Core.BusinessLayer.dll, is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. The detections in this Analytic Story are focusing on the dll loading events, file create events and network events to detect This malware. - [analytic_story://Suspicious AWS EC2 Activities] category = Cloud Security last_updated = 2018-02-09 @@ -815,7 +815,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - Get Notable History - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and risk auditing within your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Console, AWS command-line interface, and AWS SDKs and APIs to ensure that your EC2 instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your AWS EC2 instances and helps you respond and investigate those activities. @@ -826,7 +826,7 @@ version = 1 references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect new user AWS Console Login - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect new user AWS Console Login - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker. @@ -837,7 +837,7 @@ version = 2 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\ Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\ @@ -850,7 +850,7 @@ version = 1 references = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC). narrative = A virtual private cloud (VPC) is an on-demand managed cloud-computing service that isolates computing resources for each client. Inside the VPC container, the environment resembles a physical network. \ Amazon's VPC service enables you to launch EC2 instances and leverage other Amazon resources. The traffic that flows in and out of this VPC can be controlled via network access-control rules and security groups. Amazon also has a feature called VPC Flow Logs that enables you to log IP traffic going to and from the network interfaces in your VPC. This data is stored using Amazon CloudWatch Logs.\ @@ -864,7 +864,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] +searches = ["ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task", "ESCU - Get Notable History - Response Task"] description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\ This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS. @@ -876,7 +876,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities. @@ -887,7 +887,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Get Notable History - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Because most enterprise cloud infrastructure activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary.\ This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further. @@ -899,7 +899,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Detect and investigate suspicious activities by users and roles in your cloud environments. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage. @@ -911,24 +911,10 @@ version = 2 references = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Unusually Long Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems. narrative = The ability to execute arbitrary commands via the Windows CLI is a primary goal for the adversary. With access to the shell, an attacker can easily run scripts and interact with the target system. Often, attackers may only have limited access to the shell or may obtain access in unusual ways. In addition, malware may execute and interact with the CLI in ways that would be considered unusual and inconsistent with typical user activity. This provides defenders with opportunities to identify suspicious use and investigate, as appropriate. This Analytic Story contains various searches to help identify this suspicious activity, as well as others to aid you in deeper investigation. -[analytic_story://Suspicious Compiled HTML Activity] -category = Adversary Tactics -last_updated = 2021-02-11 -version = 1 -references = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://attack.mitre.org/techniques/T1218/001/", "https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa"] -maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] -spec_version = 3 -searches = ["ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule"] -description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. -narrative = Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. CHM content is displayed using underlying components of the Internet Explorer browser loaded by the HTML Help executable program (hh.exe). \ -HH.exe relies upon hhctrl.ocx to load CHM topics.This will load upon execution of a chm file. \ -During investigation, review all parallel processes and child processes. It is possible for file modification events to occur and it is best to capture the CHM file and decompile it for further analysis. \ -Upon usage of InfoTech Storage Handlers, ms-its, its, mk, itss.dll will load. - [analytic_story://Suspicious DNS Traffic] category = Adversary Tactics last_updated = 2017-09-18 @@ -936,7 +922,7 @@ version = 1 references = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses. narrative = Although DNS is one of the fundamental underlying protocols that make the Internet work, it is often ignored (perhaps because of its complexity and effectiveness). However, attackers have discovered ways to abuse the protocol to meet their objectives. One potential abuse involves manipulating DNS to hijack traffic and redirect it to an IP address under the attacker's control. This could inadvertently send users intending to visit google.com, for example, to an unrelated malicious website. Another technique involves using the DNS protocol for command-and-control activities with the attacker's malicious code or to covertly exfiltrate data. The searches within this Analytic Story look for these types of abuses. @@ -947,7 +933,7 @@ version = 1 references = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Email Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"] description = Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story. narrative = It is a common practice for attackers of all types to leverage targeted spearphishing campaigns and mass mailers to deliver weaponized email messages and attachments. Fortunately, there are a number of ways to monitor email data in Splunk to detect suspicious content.\ Once a phishing message has been detected, the next steps are to answer the following questions: \ @@ -962,7 +948,7 @@ version = 1 references = ["https://cloud.google.com/blog/product/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security", "https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect New Open GCP Storage Buckets - Rule", "ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Detect New Open GCP Storage Buckets - Rule", "ESCU - Get Notable History - Response Task"] description = Use the searches in this Analytic Story to monitor your GCP Storage buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open storage buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = Similar to other cloud providers, GCP operates on a shared responsibility model. This means the end user, you, are responsible for setting appropriate access control lists and permissions on your GCP resources.\ This Analytics Story concentrates on detecting things like open storage buckets (both read and write) along with storage bucket access from unfamiliar users and IP addresses. @@ -973,7 +959,7 @@ version = 2 references = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/techniques/T1218/005/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5"] maintainers = [{"company": "Michael Haag, Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Suspicious mshta spawn - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. narrative = One common adversary tactic is to bypass application control solutions via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta suffix. In these cases, attackers use the trusted Windows utility to proxy execution of malicious files, whether an .hta application, javascript, or VBScript.\ The searches in this story help you detect and investigate suspicious activity that may indicate that an attacker is leveraging mshta.exe to execute malicious code.\ @@ -996,23 +982,12 @@ version = 1 references = ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task", "ESCU - Investigate Okta Activity by IP Address - Response Task"] +searches = ["ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate User Activities In Okta - Response Task", "ESCU - Investigate Okta Activity by app - Response Task"] description = Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they need to stay productive. The searches in this story will help monitor your Okta environment for suspicious activities and associated user behaviors. narrative = Okta is the leading single sign on (SSO) provider, allowing users to authenticate once to Okta, and from there access a variety of web-based applications. These applications are assigned to users and allow administrators to centrally manage which users are allowed to access which applications. It also provides centralized logging to help understand how the applications are used and by whom. \ While SSO is a major convenience for users, it also provides attackers with an opportunity. If the attacker can gain access to Okta, they can access a variety of applications. As such monitoring the environment is important. \ With people moving quickly to adopt web-based applications and ways to manage them, many are still struggling to understand how best to monitor these environments. This analytic story provides searches to help monitor this environment, and identify events and activity that warrant further investigation such as credential stuffing or password spraying attacks, and users logging in from multiple locations when travel is disallowed. -[analytic_story://Suspicious Regsvcs Regasm Activity] -category = Adversary Tactics -last_updated = 2021-02-11 -version = 1 -references = ["https://attack.mitre.org/techniques/T1218/009/", "https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/evasion/windows/applocker_evasion_regasm_regsvcs.md", "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/"] -maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] -spec_version = 3 -searches = ["ESCU - Detect Regasm with no Command Line Arguments - Rule", "ESCU - Detect Regsvcs Spawning a Process - Rule", "ESCU - Detect Regsvcs with No Command Line Arguments - Rule", "ESCU - Detect Regasm with Network Connection - Rule", "ESCU - Detect Regasm Spawning a Process - Rule", "ESCU - Detect Regsvcs with Network Connection - Rule"] -description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. -narrative = Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. The following queries assist with detecting suspicious and malicious usage of Regasm.exe and Regsvcs.exe. Upon reviewing usage of Regasm.exe Regsvcs.exe, review file modification events for possible script code written. Review parallel process events for csc.exe being utilized to compile script code. - [analytic_story://Suspicious Regsvr32 Activity] category = Adversary Tactics last_updated = 2021-01-29 @@ -1031,7 +1006,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1218/011/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md", "https://lolbas-project.github.io/lolbas/Binaries/Rundll32"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule"] +searches = ["ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule"] description = Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code. narrative = One common adversary tactic is to bypass application control solutions via the rundll32.exe process. Natively, rundll32.exe will load DLLs and is a great example of a Living off the Land Binary. Rundll32.exe may load malicious DLLs by ordinals, function names or directly. The queries in this story focus on loading default DLLs, syssetup.dll, ieadvpack.dll, advpack.dll and setupapi.dll from disk that may be abused by adversaries. Additionally, two analytics developed to assist with identifying DLLRegisterServer, Start and StartW functions being called. The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging rundll32.exe to execute malicious code. @@ -1042,7 +1017,7 @@ version = 2 references = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Process Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] +searches = ["ESCU - WMI Temporary Event Subscription - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Notable History - Response Task"] description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred. narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. \ The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems.\ @@ -1055,7 +1030,7 @@ version = 1 references = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system. narrative = Attackers are developing increasingly sophisticated techniques for hijacking target servers, while evading detection. One such technique that has become progressively more common is registry modification.\ The registry is a key component of the Windows operating system. It has a hierarchical database called "registry" that contains settings, options, and values for executables. Once the threat actor gains access to a machine, they can use reg.exe to modify their account to obtain administrator-level privileges, maintain persistence, and move laterally within the environment.\ @@ -1080,7 +1055,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1127/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md", "https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Suspicious microsoft workflow compiler usage - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule"] +searches = ["ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious microsoft workflow compiler usage - Rule"] description = Monitor and detect behaviors used by attackers who leverage trusted developer utilities to execute malicious code. narrative = Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.\ The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging microsoft.workflow.compiler.exe to execute malicious code. @@ -1092,7 +1067,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1127/001/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md", "https://github.com/infosecn1nja/MaliciousMacroMSBuild", "https://github.com/xorrior/RandomPS-Scripts/blob/master/Invoke-ExecuteMSBuild.ps1", "https://lolbas-project.github.io/lolbas/Binaries/Msbuild/", "https://github.com/MHaggis/CBR-Queries/blob/master/msbuild.md"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Suspicious MSBuild Rename - Rule"] +searches = ["ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious msbuild path - Rule"] description = Monitor and detect techniques used by attackers who leverage the msbuild.exe process to execute malicious code. narrative = Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio and is native to Windows. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.\ The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.\ @@ -1116,7 +1091,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task"] description = Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation. narrative = A common attack technique is to infiltrate a cloud instance and make modifications. The adversary can then secure access to your infrastructure or hide their activities. So it's important to stay alert to changes that may indicate that your environment has been compromised. \ Searches within this Analytic Story can help you detect the presence of a threat by monitoring for EC2 instances that have been created or changed--either by users that have never previously performed these activities or by known users who modify or create instances in a way that have not been done before. This story also provides investigative searches that help you go deeper once you detect suspicious behavior. @@ -1128,7 +1103,7 @@ version = 2 references = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation. narrative = Being able to profile a host's processes within your environment can help you more quickly identify processes that seem out of place when compared to the rest of the population of hosts or asset types.\ This Analytic Story lets you identify processes that are either a) not typically seen running or b) have some sort of suspicious command-line arguments associated with them. This Analytic Story will also help you identify the user running these processes and the associated process activity on the host.\ @@ -1141,7 +1116,7 @@ version = 1 references = ["https://www.monkey.org/~dugsong/dsniff/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Protocols passing authentication in cleartext - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Protocols passing authentication in cleartext - Rule", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task"] description = Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted. narrative = Various legacy protocols operate by default in the clear, without the protections of encryption. This potentially leaks sensitive information that can be exploited by passively sniffing network traffic. Depending on the protocol, this information could be highly sensitive, or could allow for session hijacking. In addition, these protocols send authentication information, which would allow for the harvesting of usernames and passwords that could potentially be used to authenticate and compromise secondary systems. @@ -1152,7 +1127,7 @@ version = 1 references = ["https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud", "https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jim Apger"}] spec_version = 3 -searches = ["ESCU - Web Fraud - Password Sharing Across Accounts - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Web Session Information via session id - Response Task"] +searches = ["ESCU - Web Fraud - Password Sharing Across Accounts - Rule", "ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Get Web Session Information via session id - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"] description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets. narrative = The Federal Bureau of Investigations (FBI) defines Internet fraud as the use of Internet services or software with Internet access to defraud victims or to otherwise take advantage of them. According to the Bureau, Internet crime schemes are used to steal millions of dollars each year from victims and continue to plague the Internet through various methods. The agency includes phishing scams, data breaches, Denial of Service (DOS) attacks, email account compromise, malware, spoofing, and ransomware in this category.\ These crimes are not the fraud itself, but rather the attack techniques commonly employed by fraudsters in their pursuit of data that enables them to commit malicious actssuch as obtaining and using stolen credit cards. They represent a serious problem that is steadily increasing and not likely to go away anytime soon.\ @@ -1179,7 +1154,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Defense_Evasion"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Suspicious Reg exe Process - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Remote Registry Key modifications - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms. @@ -1190,7 +1165,7 @@ version = 1 references = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques. narrative = Attackers use a variety of techniques to entice users to run malicious code or to persist on an endpoint. One way to accomplish these goals is to leverage file extensions and the mechanism Windows uses to associate files with specific applications. \ Since its earliest days, Windows has used extensions to identify file types. Users have become familiar with these extensions and their application associations. For example, if users see that a file ends in `.doc` or `.docx`, they will assume that it is a Microsoft Word document and expect that double-clicking will open it using `winword.exe`. The user will typically also presume that the `.docx` file is safe. \ @@ -1205,7 +1180,7 @@ version = 2 references = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense. narrative = Because attackers often modify system logs to cover their tracks and/or to thwart the investigative process, log monitoring is an industry-recognized best practice. While there are legitimate reasons to manipulate system logs, it is still worthwhile to keep track of who manipulated the logs, when they manipulated them, and in what way they manipulated them (determining which accesses, tools, or utilities were employed). Even if no malicious activity is detected, the knowledge of an attempt to manipulate system logs may be indicative of a broader security risk that should be thoroughly investigated.\ The Analytic Story gives users two different ways to detect manipulation of Windows Event Logs and one way to detect deletion of the Update Sequence Number (USN) Change Journal. The story helps determine the history of the host and the users who have accessed it. Finally, the story aides in investigation by retrieving all the information on the process that caused these events (if the process has been identified). @@ -1217,7 +1192,7 @@ version = 2 references = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment. narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment. @@ -1228,7 +1203,7 @@ version = 2 references = ["https://attack.mitre.org/tactics/TA0004/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more. narrative = Privilege escalation is a "land-and-expand" technique, wherein an adversary gains an initial foothold on a host and then exploits its weaknesses to increase his privileges. The motivation is simple: certain actions on a Windows machine--such as installing software--may require higher-level privileges than those the attacker initially acquired. By increasing his privilege level, the attacker can gain the control required to carry out his malicious ends. This Analytic Story provides searches to detect and investigate behaviors that attackers may use to elevate their privileges in your environment. @@ -1239,7 +1214,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner. narrative = The Windows operating system uses a services architecture to allow for running code in the background, similar to a UNIX daemon. Attackers will often leverage Windows services for persistence, hiding in plain sight, seeking the ability to run privileged code that can interact with the kernel. In many cases, attackers will create a new service to host their malicious code. Attackers have also been observed modifying unnecessary or unused services to point to their own code, as opposed to what was intended. In these cases, attackers often use tools to create or modify services in ways that are not typical for most environments, providing opportunities for detection. @@ -2062,6 +2037,16 @@ annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.003"], "nist": ["PR. known_false_positives = It is possible that a legitimate user is experiencing an issue causing multiple account login failures leading to lockouts. providing_technologies = [] +[savedsearch://ESCU - Detect Exchange Web Shell - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will have a randomized name of 8 characters long. Review the file for suspect commands. Identify additional log sources, IIS included, to review source and other potential exploitation. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"]} +known_false_positives = The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product. +providing_technologies = [] + [savedsearch://ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule] type = detection asset_type = Network @@ -2169,7 +2154,7 @@ confidence = medium explanation = This search looks for reading loaded Images unique to credential dumping with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon Event Code. how_to_implement = This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 7 with powershell.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.AE", "DE.CM"]} -known_false_positives = Other tools can import the same DLLs. These tools should be part of a whitelist. +known_false_positives = Other tools can import the same DLLs. These tools should be part of a whitelist. False positives may be present with any process that authenticates or uses credentials, PowerShell included. Filter based on parent process. providing_technologies = [] [savedsearch://ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule] diff --git a/package/default/app.conf b/package/default/app.conf index 9015d88928..0621f791a2 100644 --- a/package/default/app.conf +++ b/package/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 21439 +build = 22604 [triggers] reload.analytic_stories = simple @@ -19,7 +19,7 @@ reload.content-version = simple [launcher] author = Splunk -version = 3.16.0 +version = 3.17.0 description = Explore the Analytic Stories included with ES Content Updates. [ui] diff --git a/package/default/collections.conf b/package/default/collections.conf index d2bb94cb90..5bdaf1ca5f 100644 --- a/package/default/collections.conf +++ b/package/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-03-04T19:43:29 UTC +# On Date: 2021-03-12T17:19:06 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/package/default/content-version.conf b/package/default/content-version.conf index aecc226a7f..f9a49beb45 100644 --- a/package/default/content-version.conf +++ b/package/default/content-version.conf @@ -1,2 +1,2 @@ [content-version] -version = 3.16.0 +version = 3.17.0 diff --git a/package/default/es_investigations.conf b/package/default/es_investigations.conf index 6b7797e3c5..d0295bd719 100644 --- a/package/default/es_investigations.conf +++ b/package/default/es_investigations.conf @@ -11,49 +11,49 @@ label = AWS Cryptomining description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior. disabled = 0 -panels = ["panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task"] [panel_group://workbench_panel_group_aws_network_acl_activity] label = AWS Network ACL Activity description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. disabled = 0 -panels = ["panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] +panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"] [panel_group://workbench_panel_group_aws_security_hub_alerts] label = AWS Security Hub Alerts description = This story is focused around detecting Security Hub alerts generated from AWS disabled = 0 -panels = ["panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task"] +panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task"] [panel_group://workbench_panel_group_aws_suspicious_provisioning_activities] label = AWS Suspicious Provisioning Activities description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network. disabled = 0 -panels = ["panel://workbench_panel_get_all_aws_activity_from_city___response_task", "panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_get_all_aws_activity_from_region___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_all_aws_activity_from_country___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task"] +panels = ["panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_get_all_aws_activity_from_region___response_task", "panel://workbench_panel_get_all_aws_activity_from_country___response_task", "panel://workbench_panel_get_all_aws_activity_from_city___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task"] [panel_group://workbench_panel_group_aws_user_monitoring] label = AWS User Monitoring description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment. disabled = 0 -panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_user_activities_by_user_field___response_task"] +panels = ["panel://workbench_panel_investigate_aws_user_activities_by_user_field___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_apache_struts_vulnerability] label = Apache Struts Vulnerability description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities. disabled = 0 -panels = ["panel://workbench_panel_investigate_web_posts_from_src___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_suspicious_strings_in_http_header___response_task"] +panels = ["panel://workbench_panel_investigate_web_posts_from_src___response_task", "panel://workbench_panel_investigate_suspicious_strings_in_http_header___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_asset_tracking] label = Asset Tracking description = Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further. disabled = 0 -panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task"] +panels = ["panel://workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_baron_samedit_cve_2021_3156] label = Baron Samedit CVE-2021-3156 @@ -67,14 +67,14 @@ label = Brand Monitoring description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name. disabled = 0 -panels = ["panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_email_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_email_info___response_task", "panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_cloud_cryptomining] label = Cloud Cryptomining description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. disabled = 0 -panels = ["panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task"] [panel_group://workbench_panel_group_cloud_federated_credential_abuse] label = Cloud Federated Credential Abuse @@ -95,28 +95,28 @@ label = ColdRoot MacOS RAT description = Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more. disabled = 0 -panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_network_traffic_from_src_ip___response_task"] +panels = ["panel://workbench_panel_investigate_network_traffic_from_src_ip___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_collection_and_staging] label = Collection and Staging description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_command_and_control] label = Command and Control description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators. disabled = 0 -panels = ["panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] +panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"] [panel_group://workbench_panel_group_common_phishing_frameworks] label = Common Phishing Frameworks description = Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email. disabled = 0 -panels = ["panel://workbench_panel_domain_certificate_investigation___response_task", "panel://workbench_panel_get_certificate_logs_for_a_domain___response_task"] +panels = ["panel://workbench_panel_get_certificate_logs_for_a_domain___response_task", "panel://workbench_panel_domain_certificate_investigation___response_task"] [panel_group://workbench_panel_group_container_implantation_monitoring_and_investigation] label = Container Implantation Monitoring and Investigation @@ -130,14 +130,14 @@ label = Credential Dumping description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. disabled = 0 -panels = ["panel://workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task", "panel://workbench_panel_investigate_pass_the_hash_attempts___response_task", "panel://workbench_panel_investigate_previous_unseen_user___response_task", "panel://workbench_panel_investigate_pass_the_ticket_attempts___response_task"] +panels = ["panel://workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task", "panel://workbench_panel_investigate_previous_unseen_user___response_task", "panel://workbench_panel_investigate_pass_the_hash_attempts___response_task", "panel://workbench_panel_investigate_pass_the_ticket_attempts___response_task"] [panel_group://workbench_panel_group_dhs_report_ta18_074a] label = DHS Report TA18-074A description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_file_activity___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] +panels = ["panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_file_activity___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task"] [panel_group://workbench_panel_group_dns_amplification_attacks] label = DNS Amplification Attacks @@ -165,7 +165,7 @@ label = Data Protection description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration. disabled = 0 -panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"] [panel_group://workbench_panel_group_detect_zerologon_attack] label = Detect Zerologon Attack @@ -179,7 +179,7 @@ label = Disabling Security Tools description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_dynamic_dns] label = Dynamic DNS @@ -193,7 +193,7 @@ label = Emotet Malware DHS Report TA18-201A description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] +panels = ["panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task"] [panel_group://workbench_panel_group_f5_tmui_rce_cve_2020_5902] label = F5 TMUI RCE CVE-2020-5902 @@ -221,7 +221,7 @@ label = Hidden Cobra Malware description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A. disabled = 0 -panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_outbound_emails_to_hidden_cobra_threat_actors___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] +panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_outbound_emails_to_hidden_cobra_threat_actors___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"] [panel_group://workbench_panel_group_host_redirection] label = Host Redirection @@ -242,7 +242,7 @@ label = Kubernetes Scanning Activity description = This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names. disabled = 0 -panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task", "panel://workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task"] +panels = ["panel://workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task", "panel://workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_kubernetes_sensitive_object_access_activity] label = Kubernetes Sensitive Object Access Activity @@ -263,28 +263,28 @@ label = Lateral Movement description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] +panels = ["panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task"] [panel_group://workbench_panel_group_malicious_powershell] label = Malicious PowerShell description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent. disabled = 0 -panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_monitor_backup_solution] label = Monitor Backup Solution description = Address common concerns when monitoring your backup processes. These searches can help you reduce risks from ransomware, device theft, or denial of physical access to a host by backing up data on endpoints. disabled = 0 -panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_all_backup_logs_for_host___response_task"] +panels = ["panel://workbench_panel_all_backup_logs_for_host___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_monitor_for_unauthorized_software] label = Monitor for Unauthorized Software description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_monitor_for_updates] label = Monitor for Updates @@ -293,12 +293,19 @@ disabled = 0 panels = ["panel://workbench_panel_get_notable_history___response_task"] +[panel_group://workbench_panel_group_nobelium_group] +label = NOBELIUM Group +description = Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around the world. +disabled = 0 + +panels = ["panel://workbench_panel_get_notable_history___response_task"] + [panel_group://workbench_panel_group_netsh_abuse] label = Netsh Abuse description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_office_365_detections] label = Office 365 Detections @@ -312,7 +319,7 @@ label = Orangeworm Attack Group description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry. disabled = 0 -panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_phishing_payloads] label = Phishing Payloads @@ -326,21 +333,21 @@ label = Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group. disabled = 0 -panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_prohibited_traffic_allowed_or_protocol_mismatch] label = Prohibited Traffic Allowed or Protocol Mismatch description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers. disabled = 0 -panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] +panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task"] [panel_group://workbench_panel_group_ransomware] label = Ransomware description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_backup_logs_for_endpoint___response_task", "panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] +panels = ["panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_backup_logs_for_endpoint___response_task", "panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task"] [panel_group://workbench_panel_group_ransomware_cloud] label = Ransomware Cloud @@ -375,7 +382,7 @@ label = SamSam Ransomware description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task", "panel://workbench_panel_get_backup_logs_for_endpoint___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] +panels = ["panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_backup_logs_for_endpoint___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task"] [panel_group://workbench_panel_group_silver_sparrow] label = Silver Sparrow @@ -403,21 +410,14 @@ label = Splunk Enterprise Vulnerability CVE-2018-11409 description = Reduce the risk of CVE-2018-11409, an information disclosure vulnerability within some older versions of Splunk Enterprise, with searches designed to help ensure that your Splunk system does not leak information to authenticated users. disabled = 0 -panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_network_traffic_from_src_ip___response_task"] - -[panel_group://workbench_panel_group_sunburst_malware] -label = Sunburst Malware -description = Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around the world. -disabled = 0 - -panels = ["panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_investigate_network_traffic_from_src_ip___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_suspicious_aws_ec2_activities] label = Suspicious AWS EC2 Activities description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it. disabled = 0 -panels = ["panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task"] [panel_group://workbench_panel_group_suspicious_aws_login_activities] label = Suspicious AWS Login Activities @@ -431,21 +431,21 @@ label = Suspicious AWS S3 Activities description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. disabled = 0 -panels = ["panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_aws_s3_bucket_details_via_bucketname___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_aws_s3_bucket_details_via_bucketname___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task"] [panel_group://workbench_panel_group_suspicious_aws_traffic] label = Suspicious AWS Traffic description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC). disabled = 0 -panels = ["panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] +panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"] [panel_group://workbench_panel_group_suspicious_cloud_authentication_activities] label = Suspicious Cloud Authentication Activities description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. disabled = 0 -panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_user_activities_by_user_field___response_task"] +panels = ["panel://workbench_panel_investigate_aws_user_activities_by_user_field___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_suspicious_cloud_instance_activities] label = Suspicious Cloud Instance Activities @@ -473,28 +473,21 @@ label = Suspicious Command-Line Executions description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] - -[panel_group://workbench_panel_group_suspicious_compiled_html_activity] -label = Suspicious Compiled HTML Activity -description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. -disabled = 0 - -panels = ["panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_suspicious_dns_traffic] label = Suspicious DNS Traffic description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses. disabled = 0 -panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"] [panel_group://workbench_panel_group_suspicious_emails] label = Suspicious Emails description = Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story. disabled = 0 -panels = ["panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_email_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_email_info___response_task", "panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_suspicious_gcp_storage_activities] label = Suspicious GCP Storage Activities @@ -508,21 +501,14 @@ label = Suspicious MSHTA Activity description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_suspicious_okta_activity] label = Suspicious Okta Activity description = Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they need to stay productive. The searches in this story will help monitor your Okta environment for suspicious activities and associated user behaviors. disabled = 0 -panels = ["panel://workbench_panel_investigate_okta_activity_by_app___response_task", "panel://workbench_panel_investigate_user_activities_in_okta___response_task", "panel://workbench_panel_investigate_okta_activity_by_ip_address___response_task"] - -[panel_group://workbench_panel_group_suspicious_regsvcs_regasm_activity] -label = Suspicious Regsvcs Regasm Activity -description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. -disabled = 0 - -panels = ["panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_investigate_okta_activity_by_ip_address___response_task", "panel://workbench_panel_investigate_user_activities_in_okta___response_task", "panel://workbench_panel_investigate_okta_activity_by_app___response_task"] [panel_group://workbench_panel_group_suspicious_regsvr32_activity] label = Suspicious Regsvr32 Activity @@ -543,14 +529,14 @@ label = Suspicious WMI Use description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_suspicious_windows_registry_activities] label = Suspicious Windows Registry Activities description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_suspicious_zoom_child_processes] label = Suspicious Zoom Child Processes @@ -578,28 +564,28 @@ label = Unusual AWS EC2 Modifications description = Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation. disabled = 0 -panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task"] +panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_unusual_processes] label = Unusual Processes description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_use_of_cleartext_protocols] label = Use of Cleartext Protocols description = Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted. disabled = 0 -panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"] +panels = ["panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_web_fraud_detection] label = Web Fraud Detection description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets. disabled = 0 -panels = ["panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_web_session_information_via_session_id___response_task"] +panels = ["panel://workbench_panel_get_web_session_information_via_session_id___response_task", "panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_windows_dns_sigred_cve_2020_1350] label = Windows DNS SIGRed CVE-2020-1350 @@ -613,42 +599,42 @@ label = Windows Defense Evasion Tactics description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_windows_file_extension_and_association_abuse] label = Windows File Extension and Association Abuse description = Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_windows_log_manipulation] label = Windows Log Manipulation description = Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_windows_persistence_techniques] label = Windows Persistence Techniques description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_windows_privilege_escalation] label = Windows Privilege Escalation description = Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] [panel_group://workbench_panel_group_windows_service_abuse] label = Windows Service Abuse description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner. disabled = 0 -panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] +panels = ["panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"] diff --git a/package/default/macros.conf b/package/default/macros.conf index ee1c74e244..f14dd819d8 100644 --- a/package/default/macros.conf +++ b/package/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-03-04T19:43:30 UTC +# On Date: 2021-03-12T17:19:06 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -599,6 +599,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[detect_exchange_web_shell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [detect_f5_tmui_rce_cve_2020_5902_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. diff --git a/package/default/savedsearches.conf b/package/default/savedsearches.conf index 6d741fb887..2bbc7b7539 100644 --- a/package/default/savedsearches.conf +++ b/package/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-03-04T19:43:29 UTC +# On Date: 2021-03-12T17:19:06 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -2813,6 +2813,40 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Change.All_Changes where nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.user All_Changes.result |`drop_dm_object_name("All_Changes")` |`drop_dm_object_name("Account_Management")`| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search count > 5 | `detect_excessive_user_account_lockouts_filter` +[ESCU - Detect Exchange Web Shell - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will have a randomized name of 8 characters long. Review the file for suspect commands. Identify additional log sources, IIS included, to review source and other potential exploitation. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"]} +action.escu.data_models = [] +action.escu.eli5 = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will have a randomized name of 8 characters long. Review the file for suspect commands. Identify additional log sources, IIS included, to review source and other potential exploitation. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. +action.escu.known_false_positives = The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product. +action.escu.creation_date = 2021-03-09 +action.escu.modification_date = 2021-03-09 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect Exchange Web Shell - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["HAFNIUM Group"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect Exchange Web Shell - Rule +action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" by _time span=1h Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.file_hash Filesystem.user | `drop_dm_object_name(Filesystem)` | rename process_id as aspx_pid | join aspx_pid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=w3wp.exe by _time span=1h Processes.parent_process_id Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process | `drop_dm_object_name(Processes)` | rename parent_process_id as aspx_pid | fields _time aspx_pid process_id dest process_name process_path process] | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime, lastTime, aspx_pid, process_id, user, dest, file_name, file_path, process_name, process, process_path, file_hash | `detect_exchange_web_shell_filter` + [ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule] action.escu = 0 action.escu.enabled = 1 @@ -3161,7 +3195,7 @@ action.escu.mappings = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Acti action.escu.data_models = [] action.escu.eli5 = This search looks for reading loaded Images unique to credential dumping with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon Event Code. action.escu.how_to_implement = This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 7 with powershell.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. -action.escu.known_false_positives = Other tools can import the same DLLs. These tools should be part of a whitelist. +action.escu.known_false_positives = Other tools can import the same DLLs. These tools should be part of a whitelist. False positives may be present with any process that authenticates or uses credentials, PowerShell included. Filter based on parent process. action.escu.creation_date = 2019-12-03 action.escu.modification_date = 2019-12-03 action.escu.confidence = high @@ -3451,13 +3485,13 @@ action.escu.full_search_name = ESCU - Detect Outbound SMB Traffic - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Hidden Cobra Malware", "DHS Report TA18-074A", "Sunburst Malware"] +action.escu.analytic_story = ["Hidden Cobra Malware", "DHS Report TA18-074A", "NOBELIUM Group"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Outbound SMB Traffic - Rule -action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "DHS Report TA18-074A", "Sunburst Malware"], "cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1071.002"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "DHS Report TA18-074A", "NOBELIUM Group"], "cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1071.002"], "nist": ["DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -3501,7 +3535,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe by Processes.user Processes.process_name Processes.process Processes.dest index | `drop_dm_object_name(Processes)` | rex field=process "^.*?\\\\(?[^\\\\]*\.(?:exe|bat|com|ps1))" | eval process_name = lower(process_name) | eval service_process = lower(service_process) | where process_name != service_process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_path_interception_by_creation_of_program_exe_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | rex field=process "^.*?\\\\(?[^\\\\]*\.(?:exe|bat|com|ps1))" | eval process_name = lower(process_name) | eval service_process = lower(service_process) | where process_name != service_process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_path_interception_by_creation_of_program_exe_filter` [ESCU - Detect Port Security Violation - Rule] action.escu = 0 @@ -3553,13 +3587,13 @@ action.escu.full_search_name = ESCU - Detect Prohibited Applications Spawning cm action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "Sunburst Malware"] +action.escu.analytic_story = ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "NOBELIUM Group"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Prohibited Applications Spawning cmd exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "Sunburst Malware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "NOBELIUM Group"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -4037,13 +4071,13 @@ action.escu.full_search_name = ESCU - Detect Rundll32 Inline HTA Execution - Rul action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious MSHTA Activity"] +action.escu.analytic_story = ["Suspicious MSHTA Activity", "NOBELIUM Group"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Rundll32 Inline HTA Execution - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity", "NOBELIUM Group"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -5734,13 +5768,13 @@ action.escu.full_search_name = ESCU - First Time Seen Running Windows Service - action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Windows Service Abuse", "Orangeworm Attack Group", "Sunburst Malware"] +action.escu.analytic_story = ["Windows Service Abuse", "Orangeworm Attack Group", "NOBELIUM Group"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - First Time Seen Running Windows Service - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "Orangeworm Attack Group", "Sunburst Malware"], "cis20": ["CIS 2", "CIS 9"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1569.002"], "nist": ["ID.AM", "PR.DS", "PR.AC", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "Orangeworm Attack Group", "NOBELIUM Group"], "cis20": ["CIS 2", "CIS 9"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1569.002"], "nist": ["ID.AM", "PR.DS", "PR.AC", "DE.AE"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -6966,13 +7000,13 @@ action.escu.full_search_name = ESCU - Malicious PowerShell Process - Encoded Com action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Malicious PowerShell", "Sunburst Malware"] +action.escu.analytic_story = ["Malicious PowerShell", "NOBELIUM Group"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Malicious PowerShell Process - Encoded Command - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Sunburst Malware"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1027"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "NOBELIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1027"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -8945,13 +8979,13 @@ action.escu.full_search_name = ESCU - Sc exe Manipulating Windows Services - Rul action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "Sunburst Malware"] +action.escu.analytic_story = ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "NOBELIUM Group"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Sc exe Manipulating Windows Services - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "Sunburst Malware"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "NOBELIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -8979,13 +9013,13 @@ action.escu.full_search_name = ESCU - Scheduled Task Deleted Or Created via CMD action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["DHS Report TA18-074A", "Sunburst Malware"] +action.escu.analytic_story = ["DHS Report TA18-074A", "NOBELIUM Group"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Scheduled Task Deleted Or Created via CMD - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "Sunburst Malware"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "NOBELIUM Group"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -9047,13 +9081,13 @@ action.escu.full_search_name = ESCU - Schtasks scheduling job on remote system - action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Lateral Movement", "Sunburst Malware"] +action.escu.analytic_story = ["Lateral Movement", "NOBELIUM Group"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Schtasks scheduling job on remote system - Rule -action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement", "Sunburst Malware"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement", "NOBELIUM Group"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -9387,13 +9421,13 @@ action.escu.full_search_name = ESCU - Sunburst Correlation DLL and Network Event action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Sunburst Malware"] +action.escu.analytic_story = ["NOBELIUM Group"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Sunburst Correlation DLL and Network Event - Rule -action.correlationsearch.annotations = {"analytic_story": ["Sunburst Malware"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["NOBELIUM Group"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -9421,13 +9455,13 @@ action.escu.full_search_name = ESCU - Supernova Webshell - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Sunburst Malware"] +action.escu.analytic_story = ["NOBELIUM Group"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Supernova Webshell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Sunburst Malware"], "cis20": ["CIS 4", "CIS 13", "CIS 18"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1505.003"], "nist": ["PR.DS", "ID.RA", "PR.PT", "PR.IP", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["NOBELIUM Group"], "cis20": ["CIS 4", "CIS 13", "CIS 18"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1505.003"], "nist": ["PR.DS", "ID.RA", "PR.PT", "PR.IP", "DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -10539,13 +10573,13 @@ action.escu.full_search_name = ESCU - TOR Traffic - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control", "Sunburst Malware"] +action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control", "NOBELIUM Group"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - TOR Traffic - Rule -action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control", "Sunburst Malware"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.001"], "nist": ["DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control", "NOBELIUM Group"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.001"], "nist": ["DE.AE"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -10607,13 +10641,13 @@ action.escu.full_search_name = ESCU - Uncommon Processes On Endpoint - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Windows Privilege Escalation", "Unusual Processes", "Cloud Federated Credential Abuse"] +action.escu.analytic_story = ["Windows Privilege Escalation", "Unusual Processes"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Uncommon Processes On Endpoint - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation", "Unusual Processes", "Cloud Federated Credential Abuse"], "cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.002"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation", "Unusual Processes"], "cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.002"], "nist": ["ID.AM", "PR.DS"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -11185,13 +11219,13 @@ action.escu.full_search_name = ESCU - Windows AdFind Exe - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Sunburst Malware"] +action.escu.analytic_story = ["NOBELIUM Group"] cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows AdFind Exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Sunburst Malware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1018"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["NOBELIUM Group"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1018"], "nist": ["PR.PT", "DE.CM"]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -11582,11 +11616,11 @@ search = `google_gcp_pubsub_message` type.googleapis.com/google.cloud.audit.Audi ### ESCU BASELINES ### -[batch - Baseline Of Cloud Infrastructure API Calls Per User] +[ESCU - Baseline Of Cloud Infrastructure API Calls Per User] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Baseline Of Cloud Infrastructure API Calls Per User +action.escu.full_search_name = ESCU - Baseline Of Cloud Infrastructure API Calls Per User description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. action.escu.creation_date = 2020-09-07 action.escu.modification_date = 2020-09-07 @@ -11604,11 +11638,11 @@ disabled = true is_visible = false search = | tstats count as api_calls from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time api_calls, user, HourOfDay, isWeekend | eventstats dc(api_calls) as api_calls by user, HourOfDay, isWeekend | where api_calls >= 1 | fit DensityFunction api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm show_density=true -[batch - Baseline Of Cloud Instances Destroyed] +[ESCU - Baseline Of Cloud Instances Destroyed] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Baseline Of Cloud Instances Destroyed +action.escu.full_search_name = ESCU - Baseline Of Cloud Instances Destroyed description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window. action.escu.creation_date = 2020-08-25 action.escu.modification_date = 2020-08-25 @@ -11627,11 +11661,11 @@ disabled = true is_visible = false search = | tstats count as instances_destroyed from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h | makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed, (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time instances_destroyed, HourOfDay, isWeekend | fit DensityFunction instances_destroyed by "HourOfDay,isWeekend" into cloud_excessive_instances_destroyed_v1 dist=expon show_density=true -[batch - Baseline Of Cloud Instances Launched] +[ESCU - Baseline Of Cloud Instances Launched] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Baseline Of Cloud Instances Launched +action.escu.full_search_name = ESCU - Baseline Of Cloud Instances Launched description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. action.escu.creation_date = 2020-08-14 action.escu.modification_date = 2020-08-14 @@ -11650,11 +11684,11 @@ disabled = true is_visible = false search = | tstats count as instances_launched from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched, (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time instances_launched, HourOfDay, isWeekend | fit DensityFunction instances_launched by "HourOfDay,isWeekend" into cloud_excessive_instances_created_v1 dist=expon show_density=true -[batch - Baseline Of Cloud Security Group API Calls Per User] +[ESCU - Baseline Of Cloud Security Group API Calls Per User] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Baseline Of Cloud Security Group API Calls Per User +action.escu.full_search_name = ESCU - Baseline Of Cloud Security Group API Calls Per User description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. action.escu.creation_date = 2020-09-07 action.escu.modification_date = 2020-09-07 @@ -11672,11 +11706,11 @@ disabled = true is_visible = false search = | tstats count as security_group_api_calls from datamodel=Change where All_Changes.object_category=firewall All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time security_group_api_calls, user, HourOfDay, isWeekend | eventstats dc(security_group_api_calls) as security_group_api_calls by user, HourOfDay, isWeekend | where security_group_api_calls >= 1 | fit DensityFunction security_group_api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_security_group_api_calls_v1 dist=norm show_density=true -[batch - Baseline of API Calls per User ARN] +[ESCU - Baseline of API Calls per User ARN] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Baseline of API Calls per User ARN +action.escu.full_search_name = ESCU - Baseline of API Calls per User ARN description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. action.escu.creation_date = 2018-04-09 action.escu.modification_date = 2018-04-09 @@ -11694,11 +11728,11 @@ disabled = true is_visible = false search = `cloudtrail` eventType=AwsApiCall | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup api_call_by_user_baseline | stats count -[batch - Baseline of Command Line Length - MLTK] +[ESCU - Baseline of Command Line Length - MLTK] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Baseline of Command Line Length - MLTK +action.escu.full_search_name = ESCU - Baseline of Command Line Length - MLTK description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line. action.escu.creation_date = 2019-05-08 action.escu.modification_date = 2019-05-08 @@ -11716,11 +11750,11 @@ disabled = true is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as start_time max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search user!=unknown | `security_content_ctime(start_time)`| `security_content_ctime(end_time)`| eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel -[batch - Baseline of DNS Query Length - MLTK] +[ESCU - Baseline of DNS Query Length - MLTK] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Baseline of DNS Query Length - MLTK +action.escu.full_search_name = ESCU - Baseline of DNS Query Length - MLTK description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query. action.escu.creation_date = 2019-05-08 action.escu.modification_date = 2019-05-08 @@ -11738,11 +11772,11 @@ disabled = true is_visible = false search = | tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type | search DNS.record_type=* | `drop_dm_object_name("DNS")` | eval query_length = len(query) | fit DensityFunction query_length by record_type into dns_query_pdfmodel -[batch - Baseline of Excessive AWS Instances Launched by User - MLTK] +[ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Baseline of Excessive AWS Instances Launched by User - MLTK +action.escu.full_search_name = ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. action.escu.creation_date = 2019-11-14 action.escu.modification_date = 2019-11-14 @@ -11762,11 +11796,11 @@ disabled = true is_visible = false search = `cloudtrail` eventName=RunInstances errorCode=success `ec2_excessive_runinstances_mltk_input_filter` | bucket span=10m _time | stats count as instances_launched by _time src_user | fit DensityFunction instances_launched threshold=0.0005 into ec2_excessive_runinstances_v1 -[batch - Baseline of Excessive AWS Instances Terminated by User - MLTK] +[ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Baseline of Excessive AWS Instances Terminated by User - MLTK +action.escu.full_search_name = ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. action.escu.creation_date = 2019-11-14 action.escu.modification_date = 2019-11-14 @@ -11786,11 +11820,11 @@ disabled = true is_visible = false search = `cloudtrail` eventName=TerminateInstances errorCode=success `ec2_excessive_terminateinstances_mltk_input_filter` | bucket span=10m _time | stats count as instances_terminated by _time src_user | fit DensityFunction instances_terminated threshold=0.0005 into ec2_excessive_terminateinstances_v1 -[batch - Baseline of Network ACL Activity by ARN] +[ESCU - Baseline of Network ACL Activity by ARN] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Baseline of Network ACL Activity by ARN +action.escu.full_search_name = ESCU - Baseline of Network ACL Activity by ARN description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. action.escu.creation_date = 2018-05-21 action.escu.modification_date = 2018-05-21 @@ -11808,11 +11842,11 @@ disabled = true is_visible = false search = `cloudtrail` `network_acl_events` | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | stats count -[batch - Baseline of S3 Bucket deletion activity by ARN] +[ESCU - Baseline of S3 Bucket deletion activity by ARN] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Baseline of S3 Bucket deletion activity by ARN +action.escu.full_search_name = ESCU - Baseline of S3 Bucket deletion activity by ARN description = This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. action.escu.creation_date = 2018-07-17 action.escu.modification_date = 2018-07-17 @@ -11830,11 +11864,11 @@ disabled = true is_visible = false search = `cloudtrail` eventName=DeleteBucket | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count -[batch - Baseline of SMB Traffic - MLTK] +[ESCU - Baseline of SMB Traffic - MLTK] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Baseline of SMB Traffic - MLTK +action.escu.full_search_name = ESCU - Baseline of SMB Traffic - MLTK description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week. action.escu.creation_date = 2019-05-08 action.escu.modification_date = 2019-05-08 @@ -11852,11 +11886,11 @@ disabled = true is_visible = false search = | tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, "%H") | eval DayOfWeek=strftime(_time, "%A") | `drop_dm_object_name("All_Traffic")` | fit DensityFunction count by "HourOfDay,DayOfWeek" into smb_pdfmodel -[batch - Baseline of Security Group Activity by ARN] +[ESCU - Baseline of Security Group Activity by ARN] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Baseline of Security Group Activity by ARN +action.escu.full_search_name = ESCU - Baseline of Security Group Activity by ARN description = This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. action.escu.creation_date = 2018-04-17 action.escu.modification_date = 2018-04-17 @@ -11874,11 +11908,11 @@ disabled = true is_visible = false search = `cloudtrail` `security_group_api_calls` | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup security_group_activity_baseline | stats count -[batch - Baseline of blocked outbound traffic from AWS] +[ESCU - Baseline of blocked outbound traffic from AWS] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Baseline of blocked outbound traffic from AWS +action.escu.full_search_name = ESCU - Baseline of blocked outbound traffic from AWS description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly. action.escu.creation_date = 2018-05-07 action.escu.modification_date = 2018-05-07 @@ -11896,11 +11930,11 @@ disabled = true is_visible = false search = `cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) | bucket _time span=1h | stats count as numberOfBlockedConnections by _time, src_ip | stats count(numberOfBlockedConnections) as numDataPoints, latest(numberOfBlockedConnections) as latestCount, avg(numberOfBlockedConnections) as avgBlockedConnections, stdev(numberOfBlockedConnections) as stdevBlockedConnections by src_ip | table src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections | outputlookup baseline_blocked_outbound_connections | stats count -[batch - Count of Unique IPs Connecting to Ports] +[ESCU - Count of Unique IPs Connecting to Ports] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Count of Unique IPs Connecting to Ports +action.escu.full_search_name = ESCU - Count of Unique IPs Connecting to Ports description = The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them. action.escu.creation_date = 2017-09-13 action.escu.modification_date = 2017-09-13 @@ -11918,11 +11952,11 @@ disabled = true is_visible = false search = | tstats `security_content_summariesonly` count dc(All_Traffic.src) as numberOfUniqueHosts from datamodel=Network_Traffic by All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")` | sort - count -[batch - Count of assets by category] +[ESCU - Count of assets by category] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Count of assets by category +action.escu.full_search_name = ESCU - Count of assets by category description = This search shows you every asset category you have and the assets that belong to those categories. action.escu.creation_date = 2017-09-13 action.escu.modification_date = 2017-09-13 @@ -11940,11 +11974,11 @@ disabled = true is_visible = false search = | from datamodel Identity_Management.All_Assets | stats count values(nt_host) by category | sort -count -[batch - Create a list of approved AWS service accounts] +[ESCU - Create a list of approved AWS service accounts] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Create a list of approved AWS service accounts +action.escu.full_search_name = ESCU - Create a list of approved AWS service accounts description = This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. action.escu.creation_date = 2018-12-03 action.escu.modification_date = 2018-12-03 @@ -11962,11 +11996,11 @@ disabled = true is_visible = false search = `cloudtrail` errorCode=success | rename userName as identity | search NOT [inputlookup identity_lookup_expanded | fields identity] | stats count by identity | table identity | outputlookup aws_service_accounts | stats count -[batch - DNSTwist Domain Names] +[ESCU - DNSTwist Domain Names] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - DNSTwist Domain Names +action.escu.full_search_name = ESCU - DNSTwist Domain Names description = This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches. action.escu.creation_date = 2018-10-08 action.escu.modification_date = 2018-10-08 @@ -11984,11 +12018,11 @@ disabled = true is_visible = false search = | dnstwist domainlist=domains.csv | `remove_valid_domains` | eval domain_abuse="true" | table domain, domain_abuse | outputlookup brandMonitoring_lookup | stats count -[batch - Discover DNS records] +[ESCU - Discover DNS records] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Discover DNS records +action.escu.full_search_name = ESCU - Discover DNS records description = The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup action.escu.creation_date = 2019-02-14 action.escu.modification_date = 2019-02-14 @@ -12006,11 +12040,11 @@ disabled = true is_visible = false search = | inputlookup cim_corporate_email_domains.csv | inputlookup append=T cim_corporate_web_domains.csv | inputlookup append=T cim_cloud_domains.csv | eval domain = trim(replace(domain, "\*", "")) | join domain [|tstats `security_content_summariesonly` count values(DNS.record_type) as type, values(DNS.answer) as answer from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!="unknown" DNS.answer!="" by DNS.query | rename DNS.query as query | where query!="unknown" | rex field=query "(?\w+\.\w+?)(?:$|/)"] | makemv delim=" " answer | makemv delim=" " type | sort -count | table count,domain,type,query,answer | outputlookup createinapp=true discovered_dns_records -[batch - Identify Systems Creating Remote Desktop Traffic] +[ESCU - Identify Systems Creating Remote Desktop Traffic] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Identify Systems Creating Remote Desktop Traffic +action.escu.full_search_name = ESCU - Identify Systems Creating Remote Desktop Traffic description = This search counts the numbers of times the system has generated remote desktop traffic. action.escu.creation_date = 2017-09-15 action.escu.modification_date = 2017-09-15 @@ -12028,11 +12062,11 @@ disabled = true is_visible = false search = | tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389 by All_Traffic.src | `drop_dm_object_name("All_Traffic")` | sort - count -[batch - Identify Systems Receiving Remote Desktop Traffic] +[ESCU - Identify Systems Receiving Remote Desktop Traffic] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Identify Systems Receiving Remote Desktop Traffic +action.escu.full_search_name = ESCU - Identify Systems Receiving Remote Desktop Traffic description = This search counts the numbers of times the system has created remote desktop traffic action.escu.creation_date = 2017-09-15 action.escu.modification_date = 2017-09-15 @@ -12050,11 +12084,11 @@ disabled = true is_visible = false search = | tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389 by All_Traffic.dest | `drop_dm_object_name("All_Traffic")` | sort - count -[batch - Identify Systems Using Remote Desktop] +[ESCU - Identify Systems Using Remote Desktop] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Identify Systems Using Remote Desktop +action.escu.full_search_name = ESCU - Identify Systems Using Remote Desktop description = This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. action.escu.creation_date = 2019-04-01 action.escu.modification_date = 2019-04-01 @@ -12072,11 +12106,11 @@ disabled = true is_visible = false search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name="*mstsc.exe*" by Processes.dest Processes.process_name | `drop_dm_object_name(Processes)` | sort - count -[batch - Monitor Successful Backups] +[ESCU - Monitor Successful Backups] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Monitor Successful Backups +action.escu.full_search_name = ESCU - Monitor Successful Backups description = This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. action.escu.creation_date = 2017-09-12 action.escu.modification_date = 2017-09-12 @@ -12094,11 +12128,11 @@ disabled = true is_visible = false search = `netbackup` "Disk/Partition backup completed successfully." | bucket _time span=1d | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE -[batch - Monitor Unsuccessful Backups] +[ESCU - Monitor Unsuccessful Backups] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Monitor Unsuccessful Backups +action.escu.full_search_name = ESCU - Monitor Unsuccessful Backups description = This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. action.escu.creation_date = 2017-09-12 action.escu.modification_date = 2017-09-12 @@ -12116,11 +12150,11 @@ disabled = true is_visible = false search = `netbackup` "An error occurred, failed to backup." | bucket _time span=1d | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE -[batch - Previously Seen AWS Cross Account Activity] +[ESCU - Previously Seen AWS Cross Account Activity] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen AWS Cross Account Activity +action.escu.full_search_name = ESCU - Previously Seen AWS Cross Account Activity description = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. action.escu.creation_date = 2018-06-04 action.escu.modification_date = 2018-06-04 @@ -12138,11 +12172,11 @@ disabled = true is_visible = false search = `cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId | spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=* | where requestingAccountId!=requestedAccountId | stats earliest(_time) as firstTime latest(_time) as lastTime by requestingAccountId, requestedAccountId | outputlookup previously_seen_aws_cross_account_activity | stats count -[batch - Previously Seen AWS Cross Account Activity - Initial] +[ESCU - Previously Seen AWS Cross Account Activity - Initial] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen AWS Cross Account Activity - Initial +action.escu.full_search_name = ESCU - Previously Seen AWS Cross Account Activity - Initial description = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. action.escu.creation_date = 2020-08-15 action.escu.modification_date = 2020-08-15 @@ -12160,11 +12194,11 @@ disabled = true is_visible = false search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` | rex field=user_role "arn:aws:sts:*:(?.*):" | where vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | table requestingAccountId requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity -[batch - Previously Seen AWS Cross Account Activity - Update] +[ESCU - Previously Seen AWS Cross Account Activity - Update] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen AWS Cross Account Activity - Update +action.escu.full_search_name = ESCU - Previously Seen AWS Cross Account Activity - Update description = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. action.escu.creation_date = 2020-08-15 action.escu.modification_date = 2020-08-15 @@ -12182,11 +12216,11 @@ disabled = true is_visible = false search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` | rex field=user_role "arn:aws:sts:*:(?.*):" | where vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity | stats min(firstTime) as firstTime max(lastTime) as lastTime by requestingAccountId requestedAccountId | outputlookup previously_seen_aws_cross_account_activity -[batch - Previously Seen AWS Provisioning Activity Sources] +[ESCU - Previously Seen AWS Provisioning Activity Sources] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen AWS Provisioning Activity Sources +action.escu.full_search_name = ESCU - Previously Seen AWS Provisioning Activity Sources description = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. action.escu.creation_date = 2018-03-16 action.escu.modification_date = 2018-03-16 @@ -12204,11 +12238,11 @@ disabled = true is_visible = false search = `cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceIPAddress | stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country | outputlookup previously_seen_provisioning_activity_src.csv | stats count -[batch - Previously Seen AWS Regions] +[ESCU - Previously Seen AWS Regions] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen AWS Regions +action.escu.full_search_name = ESCU - Previously Seen AWS Regions description = This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days action.escu.creation_date = 2018-01-08 action.escu.modification_date = 2018-01-08 @@ -12226,11 +12260,11 @@ disabled = true is_visible = false search = `cloudtrail` StartInstances | stats earliest(_time) as earliest latest(_time) as latest by awsRegion | outputlookup previously_seen_aws_regions.csv | stats count -[batch - Previously Seen Cloud API Calls Per User Role - Initial] +[ESCU - Previously Seen Cloud API Calls Per User Role - Initial] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen Cloud API Calls Per User Role - Initial +action.escu.full_search_name = ESCU - Previously Seen Cloud API Calls Per User Role - Initial description = This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached. action.escu.creation_date = 2020-09-03 action.escu.modification_date = 2020-09-03 @@ -12248,11 +12282,11 @@ disabled = true is_visible = false search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role -[batch - Previously Seen Cloud API Calls Per User Role - Update] +[ESCU - Previously Seen Cloud API Calls Per User Role - Update] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen Cloud API Calls Per User Role - Update +action.escu.full_search_name = ESCU - Previously Seen Cloud API Calls Per User Role - Update description = This search updates the table of the first and last times seen for every user role and command combination. action.escu.creation_date = 2020-09-03 action.escu.modification_date = 2020-09-03 @@ -12270,11 +12304,11 @@ disabled = true is_visible = false search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` | table user, command, firstTimeSeen, lastTimeSeen | inputlookup previously_seen_cloud_api_calls_per_user_role append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by user, command | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_api_calls_per_user_role_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role -[batch - Previously Seen Cloud Compute Creations By User - Initial] +[ESCU - Previously Seen Cloud Compute Creations By User - Initial] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen Cloud Compute Creations By User - Initial +action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Creations By User - Initial description = This search builds a table of previously seen users that have launched a cloud compute instance. action.escu.creation_date = 2020-08-15 action.escu.modification_date = 2020-08-15 @@ -12292,11 +12326,11 @@ disabled = true is_visible = false search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_cloud_compute_creations_by_user | stats count -[batch - Previously Seen Cloud Compute Creations By User - Update] +[ESCU - Previously Seen Cloud Compute Creations By User - Update] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen Cloud Compute Creations By User - Update +action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Creations By User - Update description = This search builds a table of previously seen users that have launched a cloud compute instance. action.escu.creation_date = 2020-08-15 action.escu.modification_date = 2020-08-15 @@ -12314,11 +12348,11 @@ disabled = true is_visible = false search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user| `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_compute_creations_by_user | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen > relative_time(now(), "-90d@d") | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_creations_by_user -[batch - Previously Seen Cloud Compute Images - Initial] +[ESCU - Previously Seen Cloud Compute Images - Initial] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen Cloud Compute Images - Initial +action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Images - Initial description = This search builds a table of previously seen images used to launch cloud compute instances action.escu.creation_date = 2020-10-08 action.escu.modification_date = 2020-10-08 @@ -12336,11 +12370,11 @@ disabled = true is_visible = false search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_images -[batch - Previously Seen Cloud Compute Images - Update] +[ESCU - Previously Seen Cloud Compute Images - Update] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen Cloud Compute Images - Update +action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Images - Update description = This search builds a table of previously seen images used to launch cloud compute instances action.escu.creation_date = 2020-08-12 action.escu.modification_date = 2020-08-12 @@ -12358,11 +12392,11 @@ disabled = true is_visible = false search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" | inputlookup append=t previously_seen_cloud_compute_images | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by image_id | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_images -[batch - Previously Seen Cloud Compute Instance Types - Initial] +[ESCU - Previously Seen Cloud Compute Instance Types - Initial] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen Cloud Compute Instance Types - Initial +action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Instance Types - Initial description = This search builds a table of previously seen cloud compute instance types action.escu.creation_date = 2020-9-03 action.escu.modification_date = 2020-9-03 @@ -12380,11 +12414,11 @@ disabled = true is_visible = false search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type | `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type != "unknown" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types -[batch - Previously Seen Cloud Compute Instance Types - Update] +[ESCU - Previously Seen Cloud Compute Instance Types - Update] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen Cloud Compute Instance Types - Update +action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Instance Types - Update description = This search builds a table of previously seen cloud compute instance types action.escu.creation_date = 2020-9-03 action.escu.modification_date = 2020-9-03 @@ -12402,11 +12436,11 @@ disabled = true is_visible = false search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type | `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type != "unknown" | inputlookup append=t previously_seen_cloud_compute_instance_types | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by instance_type | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_instance_type_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types -[batch - Previously Seen Cloud Instance Modifications By User - Initial] +[ESCU - Previously Seen Cloud Instance Modifications By User - Initial] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen Cloud Instance Modifications By User - Initial +action.escu.full_search_name = ESCU - Previously Seen Cloud Instance Modifications By User - Initial description = This search builds a table of previously seen users that have modified a cloud instance. action.escu.creation_date = 2020-07-29 action.escu.modification_date = 2020-07-29 @@ -12424,11 +12458,11 @@ disabled = true is_visible = false search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user -[batch - Previously Seen Cloud Instance Modifications By User - Update] +[ESCU - Previously Seen Cloud Instance Modifications By User - Update] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen Cloud Instance Modifications By User - Update +action.escu.full_search_name = ESCU - Previously Seen Cloud Instance Modifications By User - Update description = This search updates a table of previously seen Cloud Instance modifications that have been made by a user action.escu.creation_date = 2020-07-29 action.escu.modification_date = 2020-07-29 @@ -12446,11 +12480,11 @@ disabled = true is_visible = false search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_instance_modifications_by_user | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user -[batch - Previously Seen Cloud Provisioning Activity Sources - Initial] +[ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen Cloud Provisioning Activity Sources - Initial +action.escu.full_search_name = ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial description = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached. action.escu.creation_date = 2020-08-19 action.escu.modification_date = 2020-08-19 @@ -12468,11 +12502,11 @@ disabled = true is_visible = false search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources -[batch - Previously Seen Cloud Provisioning Activity Sources - Update] +[ESCU - Previously Seen Cloud Provisioning Activity Sources - Update] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen Cloud Provisioning Activity Sources - Update +action.escu.full_search_name = ESCU - Previously Seen Cloud Provisioning Activity Sources - Update description = This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something. It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached. action.escu.creation_date = 2020-08-20 action.escu.modification_date = 2020-08-20 @@ -12490,11 +12524,11 @@ disabled = true is_visible = false search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) | table src, firstTimeSeen, lastTimeSeen, City, Country, Region | inputlookup previously_seen_cloud_provisioning_activity_sources append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by src, City, Country, Region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_provisioning_activity_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources -[batch - Previously Seen Cloud Regions - Initial] +[ESCU - Previously Seen Cloud Regions - Initial] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen Cloud Regions - Initial +action.escu.full_search_name = ESCU - Previously Seen Cloud Regions - Initial description = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days action.escu.creation_date = 2020-09-02 action.escu.modification_date = 2020-09-02 @@ -12512,11 +12546,11 @@ disabled = true is_visible = false search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions -[batch - Previously Seen Cloud Regions - Update] +[ESCU - Previously Seen Cloud Regions - Update] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen Cloud Regions - Update +action.escu.full_search_name = ESCU - Previously Seen Cloud Regions - Update description = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days action.escu.creation_date = 2020-09-02 action.escu.modification_date = 2020-09-02 @@ -12534,11 +12568,11 @@ disabled = true is_visible = false search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_regions | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by vendor_region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_region_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions | stats count -[batch - Previously Seen EC2 AMIs] +[ESCU - Previously Seen EC2 AMIs] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen EC2 AMIs +action.escu.full_search_name = ESCU - Previously Seen EC2 AMIs description = This search builds a table of previously seen AMIs used to launch EC2 instances action.escu.creation_date = 2018-03-12 action.escu.modification_date = 2018-03-12 @@ -12556,11 +12590,11 @@ disabled = true is_visible = false search = `cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instancesSet.items{}.imageId as amiID | stats earliest(_time) as firstTime latest(_time) as lastTime by amiID | outputlookup previously_seen_ec2_amis.csv | stats count -[batch - Previously Seen EC2 Instance Types] +[ESCU - Previously Seen EC2 Instance Types] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen EC2 Instance Types +action.escu.full_search_name = ESCU - Previously Seen EC2 Instance Types description = This search builds a table of previously seen EC2 instance types action.escu.creation_date = 2018-03-08 action.escu.modification_date = 2018-03-08 @@ -12578,11 +12612,11 @@ disabled = true is_visible = false search = `cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instanceType as instanceType | fillnull value="m1.small" instanceType | stats earliest(_time) as earliest latest(_time) as latest by instanceType | outputlookup previously_seen_ec2_instance_types.csv | stats count -[batch - Previously Seen EC2 Launches By User] +[ESCU - Previously Seen EC2 Launches By User] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen EC2 Launches By User +action.escu.full_search_name = ESCU - Previously Seen EC2 Launches By User description = This search builds a table of previously seen ARNs that have launched a EC2 instance. action.escu.creation_date = 2018-03-15 action.escu.modification_date = 2018-03-15 @@ -12600,11 +12634,11 @@ disabled = true is_visible = false search = `cloudtrail` eventName=RunInstances errorCode=success | rename userIdentity.arn as arn | stats earliest(_time) as firstTime latest(_time) as lastTime by arn | outputlookup previously_seen_ec2_launches_by_user.csv | stats count -[batch - Previously Seen EC2 Modifications By User] +[ESCU - Previously Seen EC2 Modifications By User] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen EC2 Modifications By User +action.escu.full_search_name = ESCU - Previously Seen EC2 Modifications By User description = This search builds a table of previously seen ARNs that have launched a EC2 instance. action.escu.creation_date = 2018-04-05 action.escu.modification_date = 2018-04-05 @@ -12622,15 +12656,15 @@ disabled = true is_visible = false search = `cloudtrail` `ec2_modification_api_calls` errorCode=success | spath output=arn userIdentity.arn | stats earliest(_time) as firstTime latest(_time) as lastTime by arn | outputlookup previously_seen_ec2_modifications_by_user | stats count -[batch - Previously Seen Running Windows Services - Initial] +[ESCU - Previously Seen Running Windows Services - Initial] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen Running Windows Services - Initial +action.escu.full_search_name = ESCU - Previously Seen Running Windows Services - Initial description = This collects the services that have been started across your entire enterprise. action.escu.creation_date = 2020-06-23 action.escu.modification_date = 2020-06-23 -action.escu.analytic_story = ["Orangeworm Attack Group", "Windows Service Abuse", "Sunburst Malware"] +action.escu.analytic_story = ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"] action.escu.data_models = [] cron_schedule = 0 1 1 1,4,7,10 * enableSched = 1 @@ -12644,15 +12678,15 @@ disabled = true is_visible = false search = `wineventlog_system` EventCode=7036 | rex field=Message "The (?[-\(\)\s\w]+) service entered the (?\w+) state" | where state="running" | stats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen by service | outputlookup previously_seen_running_windows_services -[batch - Previously Seen Running Windows Services - Update] +[ESCU - Previously Seen Running Windows Services - Update] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen Running Windows Services - Update +action.escu.full_search_name = ESCU - Previously Seen Running Windows Services - Update description = This search returns the first and last time a Windows service was seen across your enterprise within the last hour. It then updates this information with historical data and filters out Windows services pairs that have not been seen within the specified time window. This updated table is then cached. action.escu.creation_date = 2020-06-23 action.escu.modification_date = 2020-06-23 -action.escu.analytic_story = ["Orangeworm Attack Group", "Windows Service Abuse", "Sunburst Malware"] +action.escu.analytic_story = ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"] action.escu.data_models = [] cron_schedule = 55 * * * * enableSched = 1 @@ -12666,11 +12700,11 @@ disabled = true is_visible = false search = `wineventlog_system` EventCode=7036 | rex field=Message "The (?[-\(\)\s\w]+) service entered the (?\w+) state" | where state="running" | stats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen by service | inputlookup previously_seen_running_windows_services append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by service | where lastTimeSeen > relative_time(now(), "`previously_seen_windows_service_forget_window`") | outputlookup previously_seen_running_windows_services -[batch - Previously Seen Users In CloudTrail - Update] +[ESCU - Previously Seen Users In CloudTrail - Update] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen Users In CloudTrail - Update +action.escu.full_search_name = ESCU - Previously Seen Users In CloudTrail - Update description = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. action.escu.creation_date = 2020-05-28 action.escu.modification_date = 2020-05-28 @@ -12688,11 +12722,11 @@ disabled = true is_visible = false search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins -[batch - Previously Seen Users in CloudTrail - Initial] +[ESCU - Previously Seen Users in CloudTrail - Initial] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen Users in CloudTrail - Initial +action.escu.full_search_name = ESCU - Previously Seen Users in CloudTrail - Initial description = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days. action.escu.creation_date = 2020-05-28 action.escu.modification_date = 2020-05-28 @@ -12710,11 +12744,11 @@ disabled = true is_visible = false search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins | stats count -[batch - Previously Seen Zoom Child Processes - Initial] +[ESCU - Previously Seen Zoom Child Processes - Initial] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen Zoom Child Processes - Initial +action.escu.full_search_name = ESCU - Previously Seen Zoom Child Processes - Initial description = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached. action.escu.creation_date = 2020-05-20 action.escu.modification_date = 2020-05-20 @@ -12732,11 +12766,11 @@ disabled = true is_visible = false search = | tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)` | table dest, process_name, firstTimeSeen, lastTimeSeen | outputlookup zoom_first_time_child_process -[batch - Previously Seen Zoom Child Processes - Update] +[ESCU - Previously Seen Zoom Child Processes - Update] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously Seen Zoom Child Processes - Update +action.escu.full_search_name = ESCU - Previously Seen Zoom Child Processes - Update description = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name and endpoint pairs that have not been seen within the specified time window. This updated table is outputed to disk. action.escu.creation_date = 2020-05-20 action.escu.modification_date = 2020-05-20 @@ -12754,11 +12788,11 @@ disabled = true is_visible = false search = | tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)` | table firstTimeSeen, lastTimeSeen, process_name, dest | inputlookup zoom_first_time_child_process append=t | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by process_name, dest | where lastTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_forget_window`") | outputlookup zoom_first_time_child_process -[batch - Previously seen API call per user roles in CloudTrail] +[ESCU - Previously seen API call per user roles in CloudTrail] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously seen API call per user roles in CloudTrail +action.escu.full_search_name = ESCU - Previously seen API call per user roles in CloudTrail description = This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. action.escu.creation_date = 2018-04-16 action.escu.modification_date = 2018-04-16 @@ -12776,11 +12810,11 @@ disabled = true is_visible = false search = `cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=AssumedRole | stats earliest(_time) as earliest latest(_time) as latest by userName eventName | outputlookup previously_seen_api_calls_from_user_roles | stats count -[batch - Previously seen S3 bucket access by remote IP] +[ESCU - Previously seen S3 bucket access by remote IP] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously seen S3 bucket access by remote IP +action.escu.full_search_name = ESCU - Previously seen S3 bucket access by remote IP description = This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking for S3 access events where the HTTP response code from AWS is "200" action.escu.creation_date = 2018-06-28 action.escu.modification_date = 2018-06-28 @@ -12798,11 +12832,11 @@ disabled = true is_visible = false search = `aws_s3_accesslogs` http_status=200 | stats earliest(_time) as earliest latest(_time) as latest by bucket_name remote_ip | outputlookup previously_seen_S3_access_from_remote_ip | stats count -[batch - Previously seen command line arguments] +[ESCU - Previously seen command line arguments] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously seen command line arguments +action.escu.full_search_name = ESCU - Previously seen command line arguments description = This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. action.escu.creation_date = 2019-03-01 action.escu.modification_date = 2019-03-01 @@ -12820,11 +12854,11 @@ disabled = true is_visible = false search = | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe AND Processes.process="* /c *" by Processes.process | `drop_dm_object_name(Processes)` -[batch - Previously seen users in CloudTrail] +[ESCU - Previously seen users in CloudTrail] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Previously seen users in CloudTrail +action.escu.full_search_name = ESCU - Previously seen users in CloudTrail description = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel action.escu.creation_date = 2018-04-30 action.escu.modification_date = 2018-04-30 @@ -12842,11 +12876,11 @@ disabled = true is_visible = false search = `cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) | stats earliest(_time) as firstTime latest(_time) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins_cloudtrail | stats count -[batch - Systems Ready for Spectre-Meltdown Windows Patch] +[ESCU - Systems Ready for Spectre-Meltdown Windows Patch] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Systems Ready for Spectre-Meltdown Windows Patch +action.escu.full_search_name = ESCU - Systems Ready for Spectre-Meltdown Windows Patch description = Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this key has been written, the system can then be patched for Spectre and Meltdown. action.escu.creation_date = 2018-01-08 action.escu.modification_date = 2018-01-08 @@ -12864,11 +12898,11 @@ disabled = true is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change_Analysis.All_Changes where All_Changes.object_category=registry AND (All_Changes.object_path="HKLM\Software\Microsoft\Windows\CurrentVersion\QualityCompat*") by All_Changes.dest, All_Changes.command, All_Changes.user, All_Changes.object, All_Changes.object_path | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name("All_Changes")` -[batch - Update previously seen users in CloudTrail] +[ESCU - Update previously seen users in CloudTrail] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Update previously seen users in CloudTrail +action.escu.full_search_name = ESCU - Update previously seen users in CloudTrail description = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel action.escu.creation_date = 2018-04-30 action.escu.modification_date = 2018-04-30 @@ -12886,11 +12920,11 @@ disabled = true is_visible = false search = `cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) | stats earliest(_time) AS firstTime latest(_time) AS lastTime by user src City Region Country | inputlookup append=t previously_seen_users_console_logins_cloudtrail | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins_cloudtrail -[batch - Windows Updates Install Failures] +[ESCU - Windows Updates Install Failures] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Windows Updates Install Failures +action.escu.full_search_name = ESCU - Windows Updates Install Failures description = This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. action.escu.creation_date = 2017-09-14 action.escu.modification_date = 2017-09-14 @@ -12908,11 +12942,11 @@ disabled = true is_visible = false search = | tstats `security_content_summariesonly` dc(Updates.dest) as count FROM datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=failure by _time span=1d -[batch - Windows Updates Install Successes] +[ESCU - Windows Updates Install Successes] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = support -action.escu.full_search_name = batch - Windows Updates Install Successes +action.escu.full_search_name = ESCU - Windows Updates Install Successes description = This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. action.escu.creation_date = 2017-09-14 action.escu.modification_date = 2017-09-14 diff --git a/package/default/transforms.conf b/package/default/transforms.conf index 410abc7734..fa14eb5c6e 100644 --- a/package/default/transforms.conf +++ b/package/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-03-04T19:43:29 UTC +# On Date: 2021-03-12T17:19:06 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/package/default/use_case_library.conf b/package/default/use_case_library.conf index 77f8a285d7..d40b3ba8df 100644 --- a/package/default/use_case_library.conf +++ b/package/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-03-04T19:43:30 UTC +# On Date: 2021-03-12T17:19:06 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -14,7 +14,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect role creation - Rule", "ESCU - aws detect sts get session token abuse - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - aws detect sts get session token abuse - Rule", "ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect role creation - Rule", "ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"] description = Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. narrative = Amazon Web Services (AWS) admins manage access to AWS resources and services across the enterprise using AWS's Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage AWS users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as EC2 instances, the AWS Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\ Herein lies the rub. In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\ @@ -27,7 +27,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS). It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \ @@ -41,7 +41,7 @@ version = 2 references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls. @@ -52,7 +52,7 @@ version = 1 references = ["https://aws.amazon.com/security-hub/features/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] description = This story is focused around detecting Security Hub alerts generated from AWS narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager. @@ -63,7 +63,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Get All AWS Activity From Region - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Get All AWS Activity From Region - Response Task", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network. narrative = Because most enterprise AWS activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary. \ This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further. @@ -75,7 +75,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect new API calls from user roles - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] +searches = ["ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task", "ESCU - Get Notable History - Response Task"] description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new EC2 instances and increased bandwidth usage. \ @@ -89,7 +89,7 @@ version = 1 references = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Suspicious Java Classes - Rule", "ESCU - Investigate Web POSTs From src - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task"] +searches = ["ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Investigate Web POSTs From src - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Get Notable History - Response Task"] description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities. narrative = In March of 2017, a remote code-execution vulnerability in the Jakarta Multipart parser in Apache Struts, a widely used open-source framework for creating Java web applications, was disclosed and assigned to CVE-2017-5638. About two months later, hackers exploited the flaw to carry out the world's 5th largest data breach. The target, credit giant Equifax, told investigators that it had become aware of the vulnerability two months before the attack. \ The exploit involved manipulating the `Content-Type HTTP` header to execute commands embedded in the header.\ @@ -113,7 +113,7 @@ version = 1 references = ["https://www.cisecurity.org/controls/inventory-of-authorized-and-unauthorized-devices/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Response Task"] +searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Response Task", "ESCU - Get Notable History - Response Task"] description = Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further. narrative = This Analytic Story is designed to help you develop a better understanding of what authorized and unauthorized devices are part of your enterprise. This story can help you better categorize and classify assets, providing critical business context and awareness of their assets during an incident. Information derived from this Analytic Story can be used to better inform and support other analytic stories. For successful detection, you will need to leverage the Assets and Identity Framework from Enterprise Security to populate your known assets. @@ -124,7 +124,7 @@ version = 1 references = ["https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect Baron Samedit CVE-2021-3156 Segfault - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 via OSQuery - Rule"] +searches = ["ESCU - Detect Baron Samedit CVE-2021-3156 - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 Segfault - Rule", "ESCU - Detect Baron Samedit CVE-2021-3156 via OSQuery - Rule"] description = Uncover activity consistent with CVE-2021-3156. Discovered by the Qualys Research Team, this vulnerability has been found to affect sudo across multiple Linux distributions (Ubuntu 20.04 and prior, Debian 10 and prior, Fedora 33 and prior). As this vulnerability was committed to code in July 2011, there will be many distributions affected. Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host. narrative = A non-privledged user is able to execute the sudoedit command to trigger a buffer overflow. After the successful buffer overflow, they are then able to gain root privileges on the affected host. The conditions needed to be run are a trailing "\" along with shell and edit flags. Monitoring the /var/log directory on Linux hosts using the Splunk Universal Forwarder will allow you to pick up this behavior when using the provided detection. @@ -135,7 +135,7 @@ version = 1 references = ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Email Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task"] description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name. narrative = While you can educate your users and customers about the risks and threats posed by typosquatting, phishing, and corporate espionage, human error is a persistent fact of life. Of course, your adversaries are all too aware of this reality and will happily leverage it for nefarious purposes whenever possible3phishing with lookalike addresses, embedding faux command-and-control domains in malware, and hosting malicious content on domains that closely mimic your corporate servers. This is where brand monitoring comes in.\ You can use our adaptation of `DNSTwist`, together with the support searches in this Analytic Story, to generate permutations of specified brands and external domains. Splunk can monitor email, DNS requests, and web traffic for these permutations and provide you with early warnings and situational awareness--powerful elements of an effective defense.\ @@ -148,7 +148,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Get Notable History - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \ @@ -162,7 +162,7 @@ version = 1 references = ["https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps", "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf", "https://us-cert.cisa.gov/ncas/alerts/aa21-008a"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - O365 Added Service Principal - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - AWS SAML Access by Provider User and Principal - Rule"] +searches = ["ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - AWS SAML Update identity provider - Rule"] description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements. narrative = This story is composed of detection searches based on endpoint that addresses the use of Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) related events are also addressed in specific cloud environment detection searches. @@ -173,7 +173,7 @@ version = 1 references = ["https://www.cobaltstrike.com/", "https://www.infocyte.com/blog/2020/09/02/cobalt-strike-the-new-favorite-among-thieves/", "https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/", "https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html", "https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html", "https://github.com/MichaelKoczwara/Awesome-CobaltStrike-Defence", "https://github.com/zer0yu/Awesome-CobaltStrike"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Suspicious msbuild path - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule"] +searches = ["ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious DLLHost no Command Line Arguments - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Suspicious GPUpdate no Command Line Arguments - Rule"] description = Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility. narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Cobalt Strike. Cobalt Strike has many ways to be enhanced by using aggressor scripts, malleable C2 profiles, default attack packages, and much more. For endpoint behavior, Cobalt Strike is most commonly identified via named pipes, spawn to processes, and DLL function names. Many additional variables are provided for in memory operation of the beacon implant. On the network, depending on the malleable C2 profile used, it is near infinite in the amount of ways to conceal the C2 traffic with Cobalt Strike. Not every query may be specific to Cobalt Strike the tool, but the methodologies and techniques used by it.\ Splunk Threat Research reviewed all publicly available instances of Malleabe C2 Profiles and generated a list of the most commonly used spawnto and pipenames.\ @@ -193,7 +193,7 @@ version = 1 references = ["https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/", "https://objective-see.com/blog/blog_0x2A.html", "https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jose Hernandez"}] spec_version = 3 -searches = ["ESCU - Processes Tapping Keyboard Events - Rule", "ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"] +searches = ["ESCU - Processes Tapping Keyboard Events - Rule", "ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Investigate Network Traffic From src ip - Response Task", "ESCU - Get Notable History - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more. narrative = Conventional wisdom holds that Apple's MacOS operating system is significantly less vulnerable to attack than Windows machines. While that point is debatable, it is true that attacks against MacOS systems are much less common. However, this fact does not mean that Macs are impervious to breaches. To the contrary, research has shown that that Mac malware is increasing at an alarming rate. According to AV-test, in 2018, there were 86,865 new MacOS malware variants, up from 27,338 the year before—a 31% increase. In contrast, the independent research firm found that new Windows malware had increased from 65.17M to 76.86M during that same period, less than half the rate of growth. The bottom line is that while the numbers look a lot smaller than Windows, it's definitely time to take Mac security more seriously.\ This Analytic Story addresses the ColdRoot remote access trojan (RAT), which was uploaded to Github in 2016, but was still escaping detection by the first quarter of 2018, when a new, more feature-rich variant was discovered masquerading as an Apple audio driver. Among other capabilities, the Pascal-based ColdRoot can heist passwords from users' keychains and remotely control infected machines without detection. In the initial report of his findings, Patrick Wardle, Chief Research Officer for Digita Security, explained that the new ColdRoot RAT could start and kill processes on the breached system, spawn new remote-desktop sessions, take screen captures and assemble them into a live stream of the victim's desktop, and more.\ @@ -206,7 +206,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. narrative = A common adversary goal is to identify and exfiltrate data of value from a target organization. This data may include email conversations and addresses, confidential company information, links to network design/infrastructure, important dates, and so on.\ Attacks are composed of three activities: identification, collection, and staging data for exfiltration. Identification typically involves scanning systems and observing user activity. Collection can involve the transfer of large amounts of data from various repositories. Staging/preparation includes moving data to a central location and compressing (and optionally encoding and/or encrypting) it. All of these activities provide opportunities for defenders to identify their presence. \ @@ -219,7 +219,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Protocol or Port Mismatch - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators. narrative = Threat actors typically architect and implement an infrastructure to use in various ways during the course of their attack campaigns. In some cases, they leverage this infrastructure for scanning and performing reconnaissance activities. In others, they may use this infrastructure to launch actual attacks. One of the most important functions of this infrastructure is to establish servers that will communicate with implants on compromised endpoints. These servers establish a command and control channel that is used to proxy data between the compromised endpoint and the attacker. These channels relay commands from the attacker to the compromised endpoint and the output of those commands back to the attacker.\ Because this communication is so critical for an adversary, they often use techniques designed to hide the true nature of the communications. There are many different techniques used to establish and communicate over these channels. This Analytic Story provides searches that look for a variety of the techniques used for these channels, as well as indications that these channels are active, by examining logs associated with border control devices and network-access control lists. @@ -231,7 +231,7 @@ version = 1 references = ["https://github.com/kgretzky/evilginx2", "https://attack.mitre.org/techniques/T1192/", "https://breakdev.org/evilginx-advanced-phishing-with-two-factor-authentication-bypass/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Splunk Research Team"}] spec_version = 3 -searches = ["ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule", "ESCU - Domain Certificate Investigation - Response Task", "ESCU - Get Certificate logs for a domain - Response Task"] +searches = ["ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule", "ESCU - Get Certificate logs for a domain - Response Task", "ESCU - Domain Certificate Investigation - Response Task"] description = Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email. narrative = As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Because phishing is a technique that relies on human psychology, you will never be able to eliminate this vulnerability 100%. But you can use automated detection to significantly reduce the risks.\ This Analytic Story focuses on detecting signs of MiTM attacks enabled by [EvilGinx2](https://github.com/kgretzky/evilginx2), a toolkit that sets up a transparent proxy between the targeted site and the user. In this way, the attacker is able to intercept credentials and two-factor identification tokens. It employs a proxy template to allow a registered domain to impersonate targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit, Office 365, and others. It can even register SSL certificates and camouflage them via a URL shortener, making them difficult to detect. Searches in this story look for signs of MiTM attacks enabled by EvilGinx2. @@ -254,7 +254,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task"] +searches = ["ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Previous Unseen User - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task"] description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. narrative = Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\ @@ -267,7 +267,7 @@ version = 2 references = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Create local admin accounts using net exe - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more. narrative = The frequency of nation-state cyber attacks has increased significantly over the last decade. Employing numerous tactics and techniques, these attacks continue to escalate in complexity. \ There is a wide range of motivations for these state-sponsored hacks, including stealing valuable corporate, military, or diplomatic dataѿall of which could confer advantages in various arenas. They may also target critical infrastructure. \ @@ -293,7 +293,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - DNS record changed - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - DNS Hijack Enrichment - Response Task"] +searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - DNS Hijack Enrichment - Response Task"] description = Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records. narrative = Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. One reason is its distributed nature. It relies on unstructured connections between millions of clients and servers over inherently insecure protocols.\ The gravity and extent of the importance of securing DNS from attacks is undeniable. The fallout of compromised DNS can be disastrous. Not only can hackers bring down an entire business, they can intercept confidential information, emails, and login credentials, as well. \ @@ -323,7 +323,7 @@ version = 1 references = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration. narrative = Attackers can leverage a variety of resources to compromise or exfiltrate enterprise data. Common exfiltration techniques include remote-access channels via low-risk, high-payoff active-collections operations and close-access operations using insiders and removable media. While this Analytic Story is not a comprehensive listing of all the methods by which attackers can exfiltrate data, it provides a useful starting point. @@ -334,7 +334,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://github.com/SecuraBV/CVE-2020-1472", "https://www.secura.com/blog/zero-logon", "https://nvd.nist.gov/vuln/detail/CVE-2020-1472"] maintainers = [{"company": "Jose Hernandez, Stan Miskowicz, David Dorsey, Shannon Davis Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Get Notable History - Response Task"] description = Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein attackers target a Microsoft Windows Domain Controller to reset its computer account password. The result from this attack is attackers can now provide themselves high privileges and take over Domain Controller. The included searches in this Analytic Story are designed to identify attempts to reset Domain Controller Computer Account via exploit code remotely or via the use of tool Mimikatz as payload carrier. narrative = This attack is a privilege escalation technique, where attacker targets a Netlogon secure channel connection to a domain controller, using Netlogon Remote Protocol (MS-NRPC). This vulnerability exposes vulnerable Windows Domain Controllers to be targeted via unaunthenticated RPC calls which eventually reset Domain Contoller computer account ($) providing the attacker the opportunity to exfil domain controller credential secrets and assign themselve high privileges that can lead to domain controller and potentially complete network takeover. The detection searches in this Analytic Story use Windows Event viewer events and Sysmon events to detect attack execution, these searches monitor access to the Local Security Authority Subsystem Service (LSASS) process which is an indicator of the use of Mimikatz tool which has bee updated to carry this attack payload. @@ -345,7 +345,7 @@ version = 2 references = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Unload Sysmon Filter Driver - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Unload Sysmon Filter Driver - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others. narrative = Attackers employ a variety of tactics in order to avoid detection and operate without barriers. This often involves modifying the configuration of security tools to get around them or explicitly disabling them to prevent them from running. This Analytic Story includes searches that look for activity consistent with attackers attempting to disable various security mechanisms. Such activity may involve monitoring for suspicious registry activity, as this is where much of the configuration for Windows and various other programs reside, or explicitly attempting to shut down security-related services. Other times, attackers attempt various tricks to prevent specific programs from running, such as adding the certificates with which the security tools are signed to a block list (which would prevent them from running). @@ -367,7 +367,7 @@ version = 1 references = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task"] description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment. narrative = The trojan downloader known as Emotet first surfaced in 2014, when it was discovered targeting the banking industry to steal credentials. However, according to a joint technical alert (TA) issued by three government agencies (https://www.us-cert.gov/ncas/alerts/TA18-201A), Emotet has evolved far beyond those beginnings to become what a ThreatPost article called a threat-delivery service(see https://threatpost.com/emotet-malware-evolves-beyond-banking-to-threat-delivery-service/134342/). For example, in early 2018, Emotet was found to be using its loader function to spread the Quakbot and Ransomware variants. \ According to the TA, the the malware continues to be among the most costly and destructive malware affecting the private and public sectors. Researchers have linked it to the threat group Mealybug, which has also been on the security communitys radar since 2014.\ @@ -391,7 +391,7 @@ version = 1 references = ["https://cloud.google.com/iam/docs/understanding-service-accounts"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - gcp detect oauth token abuse - Rule", "ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - gcp detect oauth token abuse - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - Get Notable History - Response Task"] description = Track when a user assumes an IAM role in another GCP account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. narrative = Google Cloud Platform (GCP) admins manage access to GCP resources and services across the enterprise using GCP Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage GCP users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as Compute instances, the GCP Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are potentially assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\ In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\ @@ -404,7 +404,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html", "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/", "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/", "https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Nishang PowershellTCPOneLine - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule"] +searches = ["ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Detect Exchange Web Shell - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Unified Messaging Service Spawning a Process - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Nishang PowershellTCPOneLine - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - W3WP Spawning Shell - Rule"] description = HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVEs in the wild - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065. narrative = On Tuesday, March 2, 2021, Microsoft released a set of security patches for its mail server, Microsoft Exchange. These patches respond to a group of vulnerabilities known to impact Exchange 2013, 2016, and 2019. It is important to note that an Exchange 2010 security update has also been issued, though the CVEs do not reference that version as being vulnerable.\ While the CVEs do not shed much light on the specifics of the vulnerabilities or exploits, the first vulnerability (CVE-2021-26855) has a remote network attack vector that allows the attacker, a group Microsoft named HAFNIUM, to authenticate as the Exchange server. Three additional vulnerabilities (CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) were also identified as part of this activity. When chained together along with CVE-2021-26855 for initial access, the attacker would have complete control over the Exchange server. This includes the ability to run code as SYSTEM and write to any path on the server.\ @@ -417,7 +417,7 @@ version = 2 references = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Create or delete windows shares using net exe - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Create or delete windows shares using net exe - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A. narrative = North Korea's government-sponsored "cyber army" has been slowly building momentum and gaining sophistication over the last 15 years or so. As a result, the group's activity, which the US government refers to as "Hidden Cobra," has surreptitiously crept onto the collective radar as a preeminent global threat.\ These state-sponsored actors are thought to be responsible for everything from a hack on a South Korean nuclear plant to an attack on Sony in anticipation of its release of the movie "The Interview" at the end of 2014. They're also notorious for cyberespionage. In recent years, the group seems to be focused on financial crimes, such as cryptojacking.\ @@ -431,7 +431,7 @@ version = 1 references = ["https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-hijacks/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Windows hosts file modification - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Windows hosts file modification - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task"] description = Detect evidence of tactics used to redirect traffic from a host to a destination other than the one intended--potentially one that is part of an adversary's attack infrastructure. An example is redirecting communications regarding patches and updates or misleading users into visiting a malicious website. narrative = Attackers will often attempt to manipulate client communications for nefarious purposes. In some cases, an attacker may endeavor to modify a local host file to redirect communications with resources (such as antivirus or system-update services) to prevent clients from receiving patches or updates. In other cases, an attacker might use this tactic to have the client connect to a site that looks like the intended site, but instead installs malware or collects information from the victim. Additionally, an attacker may redirect a victim in order to execute a MITM attack and observe communications. @@ -467,7 +467,7 @@ version = 1 references = ["https://github.com/splunk/cloud-datamodel-security-research"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task"] +searches = ["ESCU - Kubernetes Azure scan fingerprint - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"] description = This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitve information and management priviledges of production workloads, microservices and applications. These searches allow operator to detect suspicious unauthenticated requests from the internet to kubernetes cluster. @@ -478,7 +478,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule", "ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Get Notable History - Response Task"] description = This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive objects within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes sensitive objects. @@ -489,7 +489,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule", "ESCU - Kubernetes GCP detect sensitive role access - Rule", "ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule", "ESCU - Kubernetes AWS detect most active service accounts by pod - Rule", "ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule", "ESCU - Kubernetes GCP detect most active service accounts by pod - Rule", "ESCU - Kubernetes AWS detect RBAC authorization by account - Rule", "ESCU - Kubernetes AWS detect sensitive role access - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Kubernetes GCP detect sensitive role access - Rule", "ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes AWS detect sensitive role access - Rule", "ESCU - Kubernetes AWS detect RBAC authorization by account - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule", "ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule", "ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule", "ESCU - Kubernetes AWS detect most active service accounts by pod - Rule", "ESCU - Kubernetes GCP detect most active service accounts by pod - Rule", "ESCU - Get Notable History - Response Task"] description = This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive roles within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes role activities @@ -500,7 +500,7 @@ version = 2 references = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task"] description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts. narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\ Indications of lateral movement can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash, or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or "crown jewels" to a persistent threat actor.\ @@ -515,7 +515,7 @@ version = 4 references = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Any Powershell DownloadFile - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task"] description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent. narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope.\ The following factors may assist you in determining whether the event is malicious: \ @@ -535,7 +535,7 @@ version = 1 references = ["https://www.carbonblack.com/2016/03/04/tracking-locky-ransomware-using-carbon-black/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Unsuccessful Netbackup backups - Rule", "ESCU - Extended Period Without Successful Netbackup Backups - Rule", "ESCU - Get Notable History - Response Task", "ESCU - All backup logs for host - Response Task"] +searches = ["ESCU - Extended Period Without Successful Netbackup Backups - Rule", "ESCU - Unsuccessful Netbackup backups - Rule", "ESCU - All backup logs for host - Response Task", "ESCU - Get Notable History - Response Task"] description = Address common concerns when monitoring your backup processes. These searches can help you reduce risks from ransomware, device theft, or denial of physical access to a host by backing up data on endpoints. narrative = Having backups is a standard best practice that helps ensure continuity of business operations. Having mature backup processes can also help you reduce the risks of many security-related incidents and streamline your response processes. The detection searches in this Analytic Story will help you identify systems that have backup failures, as well as systems that have not been backed up for an extended period of time. The story will also return the notable event history and all of the backup logs for an endpoint. @@ -546,7 +546,7 @@ version = 1 references = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment. narrative = It is critical to identify unauthorized software and processes running on enterprise endpoints and determine whether they are likely to be malicious. This Analytic Story requires the user to populate the Interesting Processes table within Enterprise Security with prohibited processes. An included support search will augment this data, adding information on processes thought to be malicious. This search requires data from endpoint detection-and-response solutions, endpoint data sources (such as Sysmon), or Windows Event Logs--assuming that the Active Directory administrator has enabled process tracking within the System Event Audit Logs.\ It is important to investigate any software identified as suspicious, in order to understand how it was installed or executed. Analyzing authentication logs or any historic notable events might elicit additional investigative leads of interest. For best results, schedule the search to run every two weeks. @@ -564,6 +564,17 @@ narrative = It is a common best practice to ensure that endpoints are being patc Searches in this analytic story are designed to help analysts monitor endpoints for system patches and/or updates. This helps analysts identify any systems that are not successfully updated in a timely matter.\ Microsoft releases updates for Windows systems on a monthly cadence. They should be installed as soon as possible after following internal testing and validation procedures. Patches and updates for other systems or applications are typically released as needed. +[analytic_story://NOBELIUM Group] +category = Adversary Tactics +last_updated = 2020-12-14 +version = 2 +references = ["https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/", "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"] +maintainers = [{"company": "Michael Haag, Splunk", "email": "-", "name": "Patrick Bareiss"}] +spec_version = 3 +searches = ["ESCU - Supernova Webshell - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Sunburst Correlation DLL and Network Event - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Windows AdFind Exe - Rule", "ESCU - TOR Traffic - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Schtasks scheduling job on remote system - Rule"] +description = Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around the world. +narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) of the NOBELIUM Group. The threat actor behind sunburst compromised the SolarWinds.Orion.Core.BusinessLayer.dll, is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. The detections in this Analytic Story are focusing on the dll loading events, file create events and network events to detect This malware. + [analytic_story://Netsh Abuse] category = Abuse last_updated = 2017-01-05 @@ -571,7 +582,7 @@ version = 1 references = ["https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Processes launching netsh - Rule", "ESCU - Processes created by netsh - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system. narrative = It is a common practice for attackers of all types to leverage native Windows tools and functionality to execute commands for malicious reasons. One such tool on Windows OS is `netsh.exe`,a command-line scripting utility that allows you to--either locally or remotely--display or modify the network configuration of a computer that is currently running. `Netsh.exe` can be used to discover and disable local firewall settings. It can also be used to set up a remote connection to a host from an infected system.\ To get started, run the detection search to identify parent processes of `netsh.exe`. @@ -583,7 +594,7 @@ version = 1 references = ["https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}] spec_version = 3 -searches = ["ESCU - O365 Added Service Principal - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - High Number of Login Failures from a single source - Rule"] +searches = ["ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - High Number of Login Failures from a single source - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule"] description = This story is focused around detecting Office 365 Attacks. narrative = More and more companies are using Microsofts Office 365 cloud offering. Therefore, we see more and more attacks against Office 365. This story provides various detections for Office 365 attacks. @@ -594,7 +605,7 @@ version = 2 references = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task"] description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry. narrative = In May of 2018, the attack group Orangeworm was implicated for installing a custom backdoor called Trojan.Kwampirs within large international healthcare corporations in the United States, Europe, and Asia. This malware provides the attackers with remote access to the target system, decrypting and extracting a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.\ Awareness of the Orangeworm group first surfaced in January, 2015. It has conducted targeted attacks against related industries, as well, such as pharmaceuticals and healthcare IT solution providers.\ @@ -608,7 +619,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Splunk Research Team"}] spec_version = 3 -searches = ["ESCU - Detect Oulook exe writing a zip file - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Get Parent Process Info - Response Task"] +searches = ["ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Detect Oulook exe writing a zip file - Rule", "ESCU - Get Parent Process Info - Response Task"] description = Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack. narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as [91% of all successful attacks](https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \ As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Worse, because its success relies on the gullibility of humans, it's impossible to completely "automate" it out of your environment. However, you can use ES and ESCU to detect and investigate potentially malicious payloads injected into your environment subsequent to a phishing attack. \ @@ -626,7 +637,7 @@ version = 1 references = ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"] maintainers = [{"company": "iDefense", "email": "-", "name": "iDefense Cyber Espionage Team"}] spec_version = 3 -searches = ["ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task"] description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group. narrative = This story was created as a joint effort between iDefense and Splunk.\ iDefense analysts have recently discovered a Windows executable file that, upon execution, spoofs a decryption tool and then drops a file that appears to be the custom-built javascript backdoor, "Orz," which is associated with the threat actors known as MUDCARP (as well as "temp.Periscope" and "Leviathan"). The file is executed using Wscript.\ @@ -664,7 +675,7 @@ version = 1 references = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"] description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers. narrative = A traditional security best practice is to control the ports, protocols, and services allowed within your environment. By limiting the services and protocols to those explicitly approved by policy, administrators can minimize the attack surface. The combined effect allows both network defenders and security controls to focus and not be mired in superfluous traffic or data types. Looking for deviations to policy can identify attacker activity that abuses services and protocols to run on alternate or non-standard ports in the attempt to avoid detection or frustrate forensic analysts. @@ -675,7 +686,7 @@ version = 1 references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - TOR Traffic - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. @@ -697,7 +708,7 @@ version = 1 references = ["https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html", "https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Port Security Violation - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Get Notable History - Response Task"] description = Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers. narrative = Networking devices, such as routers and switches, are often overlooked as resources that attackers will leverage to subvert an enterprise. Advanced threats actors have shown a proclivity to target these critical assets as a means to siphon and redirect network traffic, flash backdoored operating systems, and implement cryptographic weakened algorithms to more easily decrypt network traffic.\ This Analytic Story helps you gain a better understanding of how your network devices are interacting with your hosts. By compromising your network devices, attackers can obtain direct access to the company's internal infrastructure— effectively increasing the attack surface and accessing private services/data. @@ -709,7 +720,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/detecting-ryuk-using-splunk-attack-range.html", "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jose Hernandez"}] spec_version = 3 -searches = ["ESCU - Common Ransomware Notes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Windows connhost exe started forcefully - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Spike in File Writes - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Windows connhost exe started forcefully - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Get Notable History - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Ryuk ransomware, including looking for file writes associated with Ryuk, Stopping Security Access Manager, DisableAntiSpyware registry key modification, suspicious psexec use, and more. narrative = Cybersecurity Infrastructure Security Agency (CISA) released Alert (AA20-302A) on October 28th called “Ransomware Activity Targeting the Healthcare and Public Health Sector.” This alert details TTPs associated with ongoing and possible imminent attacks against the Healthcare sector, and is a joint advisory in coordination with other U.S. Government agencies. The objective of these malicious campaigns is to infiltrate targets in named sectors and to drop ransomware payloads, which will likely cause disruption of service and increase risk of actual harm to the health and safety of patients at hospitals, even with the aggravant of an ongoing COVID-19 pandemic. This document specifically refers to several crimeware exploitation frameworks, emphasizing the use of Ryuk ransomware as payload. The Ryuk ransomware payload is not new. It has been well documented and identified in multiple variants. Payloads need a carrier, and for Ryuk it has often been exploitation frameworks such as Cobalt Strike, or popular crimeware frameworks such as Emotet or Trickbot. @@ -732,7 +743,7 @@ version = 1 references = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Common Ransomware Notes - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Spike in File Writes - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get History Of Email Sources - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more. narrative = The first version of the SamSam ransomware (a.k.a. Samas or SamsamCrypt) was launched in 2015 by a group of Iranian threat actors. The malicious software has affected and continues to affect thousands of victims and has raised almost $6M in ransom.\ Although categorized under the heading of ransomware, SamSam campaigns have some importance distinguishing characteristics. Most notable is the fact that conventional ransomware is a numbers game. Perpetrators use a "spray-and-pray" approach with phishing campaigns or other mechanisms, charging a small ransom (typically under $1,000). The goal is to find a large number of victims willing to pay these mini-ransoms, adding up to a lucrative payday. They use relatively simple methods for infecting systems.\ @@ -748,7 +759,7 @@ version = 1 references = ["https://redcanary.com/blog/clipping-silver-sparrows-wings/", "https://www.sentinelone.com/blog/5-things-you-need-to-know-about-silver-sparrow/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Suspicious PlistBuddy Usage via OSquery - Rule", "ESCU - Suspicious SQLite3 LSQuarantine Behavior - Rule", "ESCU - Suspicious PlistBuddy Usage - Rule", "ESCU - Suspicious Curl Network Connection - Rule"] +searches = ["ESCU - Suspicious Curl Network Connection - Rule", "ESCU - Suspicious PlistBuddy Usage - Rule", "ESCU - Suspicious PlistBuddy Usage via OSquery - Rule", "ESCU - Suspicious SQLite3 LSQuarantine Behavior - Rule"] description = Silver Sparrow, identified by Red Canary Intelligence, is a new forward looking MacOS (Intel and M1) malicious software downloader utilizing JavaScript for execution and a launchAgent to establish persistence. narrative = Silver Sparrow works is a dropper and uses typical persistence mechanisms on a Mac. It is cross platform, covering both Intel and Apple M1 architecture. To this date, no implant has been downloaded for malicious purposes. During installation of the update.pkg or updater.pkg file, the malicious software utilizes JavaScript to generate files and scripts on disk for persistence.These files later download a implant from an S3 bucket every hour. This analytic assists with identifying different types of macOS malware families establishing LaunchAgent persistence. Per SentinelOne source, it is predicted that Silver Sparrow is likely selling itself as a mechanism to 3rd party “affiliates” or pay-per-install (PPI) partners, typically seen as commodity adware/malware. Additional indicators and behaviors may be found within the references. @@ -790,24 +801,13 @@ version = 1 references = ["https://nvd.nist.gov/vuln/detail/CVE-2018-11409", "https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings", "https://www.exploit-db.com/exploits/44865/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"] +searches = ["ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Investigate Network Traffic From src ip - Response Task", "ESCU - Get Notable History - Response Task"] description = Reduce the risk of CVE-2018-11409, an information disclosure vulnerability within some older versions of Splunk Enterprise, with searches designed to help ensure that your Splunk system does not leak information to authenticated users. narrative = Although there have been no reports of it being exploited, Splunk Enterprise versions through 7.0.1 reportedly have a vulnerability that may expose information through a REST endpoint (read more here: https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings). NIST has included it in its vulnerability database (read more here: https://nvd.nist.gov/vuln/detail/CVE-2018-11409). The REST endpoint that exposes system information is also necessary for the proper operation of Splunk clustering and instrumentation. Customers should upgrade to the latest version to reduce the risk of this vulnerability.\ Splunk Enterprise exposes partial information about the host operating system, hardware, and Splunk license. Splunk Enterprise before 6.6.0 exposes this information without authentication. Splunk Enterprise 6.6.0 and later exposes this information only to authenticated Splunk users. Based on the information exposure, Splunk characterizes this issue as a low severity impact.\ Read more in Splunk's official response: https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings.\ A detection search within this Analytic Story looks for vulnerabilities described in CVE-2018-11409: Information Exposure (https://nvd.nist.gov/vuln/detail/CVE-2018-11409). If it turns up activities that may be specific, you can use the included investigative searches to return information regarding web activity and network traffic by src_ip. -[analytic_story://Sunburst Malware] -category = Adversary Tactics -last_updated = 2020-12-14 -version = 1 -references = ["https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"] -maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}] -spec_version = 3 -searches = ["ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Sunburst Correlation DLL and Network Event - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Supernova Webshell - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Windows AdFind Exe - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Detect Outbound SMB Traffic - Rule"] -description = Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around the world. -narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from the Sunburst malware. The threat actor behind sunburst compromised the SolarWinds.Orion.Core.BusinessLayer.dll, is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. The detections in this Analytic Story are focusing on the dll loading events, file create events and network events to detect This malware. - [analytic_story://Suspicious AWS EC2 Activities] category = Cloud Security last_updated = 2018-02-09 @@ -815,7 +815,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - Get Notable History - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"] description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and risk auditing within your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Console, AWS command-line interface, and AWS SDKs and APIs to ensure that your EC2 instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your AWS EC2 instances and helps you respond and investigate those activities. @@ -826,7 +826,7 @@ version = 1 references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect new user AWS Console Login - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect new user AWS Console Login - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker. @@ -837,7 +837,7 @@ version = 2 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\ Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\ @@ -850,7 +850,7 @@ version = 1 references = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC). narrative = A virtual private cloud (VPC) is an on-demand managed cloud-computing service that isolates computing resources for each client. Inside the VPC container, the environment resembles a physical network. \ Amazon's VPC service enables you to launch EC2 instances and leverage other Amazon resources. The traffic that flows in and out of this VPC can be controlled via network access-control rules and security groups. Amazon also has a feature called VPC Flow Logs that enables you to log IP traffic going to and from the network interfaces in your VPC. This data is stored using Amazon CloudWatch Logs.\ @@ -864,7 +864,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] +searches = ["ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task", "ESCU - Get Notable History - Response Task"] description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\ This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS. @@ -876,7 +876,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities. @@ -887,7 +887,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Get Notable History - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Because most enterprise cloud infrastructure activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary.\ This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further. @@ -899,7 +899,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Detect and investigate suspicious activities by users and roles in your cloud environments. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage. @@ -911,24 +911,10 @@ version = 2 references = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Unusually Long Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems. narrative = The ability to execute arbitrary commands via the Windows CLI is a primary goal for the adversary. With access to the shell, an attacker can easily run scripts and interact with the target system. Often, attackers may only have limited access to the shell or may obtain access in unusual ways. In addition, malware may execute and interact with the CLI in ways that would be considered unusual and inconsistent with typical user activity. This provides defenders with opportunities to identify suspicious use and investigate, as appropriate. This Analytic Story contains various searches to help identify this suspicious activity, as well as others to aid you in deeper investigation. -[analytic_story://Suspicious Compiled HTML Activity] -category = Adversary Tactics -last_updated = 2021-02-11 -version = 1 -references = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://attack.mitre.org/techniques/T1218/001/", "https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa"] -maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] -spec_version = 3 -searches = ["ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule"] -description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. -narrative = Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. CHM content is displayed using underlying components of the Internet Explorer browser loaded by the HTML Help executable program (hh.exe). \ -HH.exe relies upon hhctrl.ocx to load CHM topics.This will load upon execution of a chm file. \ -During investigation, review all parallel processes and child processes. It is possible for file modification events to occur and it is best to capture the CHM file and decompile it for further analysis. \ -Upon usage of InfoTech Storage Handlers, ms-its, its, mk, itss.dll will load. - [analytic_story://Suspicious DNS Traffic] category = Adversary Tactics last_updated = 2017-09-18 @@ -936,7 +922,7 @@ version = 1 references = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses. narrative = Although DNS is one of the fundamental underlying protocols that make the Internet work, it is often ignored (perhaps because of its complexity and effectiveness). However, attackers have discovered ways to abuse the protocol to meet their objectives. One potential abuse involves manipulating DNS to hijack traffic and redirect it to an IP address under the attacker's control. This could inadvertently send users intending to visit google.com, for example, to an unrelated malicious website. Another technique involves using the DNS protocol for command-and-control activities with the attacker's malicious code or to covertly exfiltrate data. The searches within this Analytic Story look for these types of abuses. @@ -947,7 +933,7 @@ version = 1 references = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Email Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"] description = Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story. narrative = It is a common practice for attackers of all types to leverage targeted spearphishing campaigns and mass mailers to deliver weaponized email messages and attachments. Fortunately, there are a number of ways to monitor email data in Splunk to detect suspicious content.\ Once a phishing message has been detected, the next steps are to answer the following questions: \ @@ -962,7 +948,7 @@ version = 1 references = ["https://cloud.google.com/blog/product/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security", "https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect New Open GCP Storage Buckets - Rule", "ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Detect New Open GCP Storage Buckets - Rule", "ESCU - Get Notable History - Response Task"] description = Use the searches in this Analytic Story to monitor your GCP Storage buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open storage buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = Similar to other cloud providers, GCP operates on a shared responsibility model. This means the end user, you, are responsible for setting appropriate access control lists and permissions on your GCP resources.\ This Analytics Story concentrates on detecting things like open storage buckets (both read and write) along with storage bucket access from unfamiliar users and IP addresses. @@ -973,7 +959,7 @@ version = 2 references = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/techniques/T1218/005/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5"] maintainers = [{"company": "Michael Haag, Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Suspicious mshta spawn - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. narrative = One common adversary tactic is to bypass application control solutions via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta suffix. In these cases, attackers use the trusted Windows utility to proxy execution of malicious files, whether an .hta application, javascript, or VBScript.\ The searches in this story help you detect and investigate suspicious activity that may indicate that an attacker is leveraging mshta.exe to execute malicious code.\ @@ -996,23 +982,12 @@ version = 1 references = ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task", "ESCU - Investigate Okta Activity by IP Address - Response Task"] +searches = ["ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate User Activities In Okta - Response Task", "ESCU - Investigate Okta Activity by app - Response Task"] description = Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they need to stay productive. The searches in this story will help monitor your Okta environment for suspicious activities and associated user behaviors. narrative = Okta is the leading single sign on (SSO) provider, allowing users to authenticate once to Okta, and from there access a variety of web-based applications. These applications are assigned to users and allow administrators to centrally manage which users are allowed to access which applications. It also provides centralized logging to help understand how the applications are used and by whom. \ While SSO is a major convenience for users, it also provides attackers with an opportunity. If the attacker can gain access to Okta, they can access a variety of applications. As such monitoring the environment is important. \ With people moving quickly to adopt web-based applications and ways to manage them, many are still struggling to understand how best to monitor these environments. This analytic story provides searches to help monitor this environment, and identify events and activity that warrant further investigation such as credential stuffing or password spraying attacks, and users logging in from multiple locations when travel is disallowed. -[analytic_story://Suspicious Regsvcs Regasm Activity] -category = Adversary Tactics -last_updated = 2021-02-11 -version = 1 -references = ["https://attack.mitre.org/techniques/T1218/009/", "https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/evasion/windows/applocker_evasion_regasm_regsvcs.md", "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/"] -maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] -spec_version = 3 -searches = ["ESCU - Detect Regasm with no Command Line Arguments - Rule", "ESCU - Detect Regsvcs Spawning a Process - Rule", "ESCU - Detect Regsvcs with No Command Line Arguments - Rule", "ESCU - Detect Regasm with Network Connection - Rule", "ESCU - Detect Regasm Spawning a Process - Rule", "ESCU - Detect Regsvcs with Network Connection - Rule"] -description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. -narrative = Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. The following queries assist with detecting suspicious and malicious usage of Regasm.exe and Regsvcs.exe. Upon reviewing usage of Regasm.exe Regsvcs.exe, review file modification events for possible script code written. Review parallel process events for csc.exe being utilized to compile script code. - [analytic_story://Suspicious Regsvr32 Activity] category = Adversary Tactics last_updated = 2021-01-29 @@ -1031,7 +1006,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1218/011/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md", "https://lolbas-project.github.io/lolbas/Binaries/Rundll32"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule"] +searches = ["ESCU - Suspicious Rundll32 Rename - Rule", "ESCU - Suspicious Rundll32 no Command Line Arguments - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule"] description = Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code. narrative = One common adversary tactic is to bypass application control solutions via the rundll32.exe process. Natively, rundll32.exe will load DLLs and is a great example of a Living off the Land Binary. Rundll32.exe may load malicious DLLs by ordinals, function names or directly. The queries in this story focus on loading default DLLs, syssetup.dll, ieadvpack.dll, advpack.dll and setupapi.dll from disk that may be abused by adversaries. Additionally, two analytics developed to assist with identifying DLLRegisterServer, Start and StartW functions being called. The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging rundll32.exe to execute malicious code. @@ -1042,7 +1017,7 @@ version = 2 references = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Process Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] +searches = ["ESCU - WMI Temporary Event Subscription - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Notable History - Response Task"] description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred. narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. \ The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems.\ @@ -1055,7 +1030,7 @@ version = 1 references = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system. narrative = Attackers are developing increasingly sophisticated techniques for hijacking target servers, while evading detection. One such technique that has become progressively more common is registry modification.\ The registry is a key component of the Windows operating system. It has a hierarchical database called "registry" that contains settings, options, and values for executables. Once the threat actor gains access to a machine, they can use reg.exe to modify their account to obtain administrator-level privileges, maintain persistence, and move laterally within the environment.\ @@ -1080,7 +1055,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1127/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md", "https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Suspicious microsoft workflow compiler usage - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule"] +searches = ["ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious microsoft workflow compiler usage - Rule"] description = Monitor and detect behaviors used by attackers who leverage trusted developer utilities to execute malicious code. narrative = Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.\ The searches in this story help you detect and investigate suspicious activity that may indicate that an adversary is leveraging microsoft.workflow.compiler.exe to execute malicious code. @@ -1092,7 +1067,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1127/001/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md", "https://github.com/infosecn1nja/MaliciousMacroMSBuild", "https://github.com/xorrior/RandomPS-Scripts/blob/master/Invoke-ExecuteMSBuild.ps1", "https://lolbas-project.github.io/lolbas/Binaries/Msbuild/", "https://github.com/MHaggis/CBR-Queries/blob/master/msbuild.md"] maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Suspicious MSBuild Rename - Rule"] +searches = ["ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious msbuild path - Rule"] description = Monitor and detect techniques used by attackers who leverage the msbuild.exe process to execute malicious code. narrative = Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio and is native to Windows. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.\ The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.\ @@ -1116,7 +1091,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get Notable History - Response Task"] description = Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation. narrative = A common attack technique is to infiltrate a cloud instance and make modifications. The adversary can then secure access to your infrastructure or hide their activities. So it's important to stay alert to changes that may indicate that your environment has been compromised. \ Searches within this Analytic Story can help you detect the presence of a threat by monitoring for EC2 instances that have been created or changed--either by users that have never previously performed these activities or by known users who modify or create instances in a way that have not been done before. This story also provides investigative searches that help you go deeper once you detect suspicious behavior. @@ -1128,7 +1103,7 @@ version = 2 references = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation. narrative = Being able to profile a host's processes within your environment can help you more quickly identify processes that seem out of place when compared to the rest of the population of hosts or asset types.\ This Analytic Story lets you identify processes that are either a) not typically seen running or b) have some sort of suspicious command-line arguments associated with them. This Analytic Story will also help you identify the user running these processes and the associated process activity on the host.\ @@ -1141,7 +1116,7 @@ version = 1 references = ["https://www.monkey.org/~dugsong/dsniff/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Protocols passing authentication in cleartext - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Protocols passing authentication in cleartext - Rule", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task"] description = Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted. narrative = Various legacy protocols operate by default in the clear, without the protections of encryption. This potentially leaks sensitive information that can be exploited by passively sniffing network traffic. Depending on the protocol, this information could be highly sensitive, or could allow for session hijacking. In addition, these protocols send authentication information, which would allow for the harvesting of usernames and passwords that could potentially be used to authenticate and compromise secondary systems. @@ -1152,7 +1127,7 @@ version = 1 references = ["https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud", "https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jim Apger"}] spec_version = 3 -searches = ["ESCU - Web Fraud - Password Sharing Across Accounts - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Web Session Information via session id - Response Task"] +searches = ["ESCU - Web Fraud - Password Sharing Across Accounts - Rule", "ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Get Web Session Information via session id - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"] description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets. narrative = The Federal Bureau of Investigations (FBI) defines Internet fraud as the use of Internet services or software with Internet access to defraud victims or to otherwise take advantage of them. According to the Bureau, Internet crime schemes are used to steal millions of dollars each year from victims and continue to plague the Internet through various methods. The agency includes phishing scams, data breaches, Denial of Service (DOS) attacks, email account compromise, malware, spoofing, and ransomware in this category.\ These crimes are not the fraud itself, but rather the attack techniques commonly employed by fraudsters in their pursuit of data that enables them to commit malicious actssuch as obtaining and using stolen credit cards. They represent a serious problem that is steadily increasing and not likely to go away anytime soon.\ @@ -1179,7 +1154,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Defense_Evasion"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Suspicious Reg exe Process - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Remote Registry Key modifications - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms. @@ -1190,7 +1165,7 @@ version = 1 references = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques. narrative = Attackers use a variety of techniques to entice users to run malicious code or to persist on an endpoint. One way to accomplish these goals is to leverage file extensions and the mechanism Windows uses to associate files with specific applications. \ Since its earliest days, Windows has used extensions to identify file types. Users have become familiar with these extensions and their application associations. For example, if users see that a file ends in `.doc` or `.docx`, they will assume that it is a Microsoft Word document and expect that double-clicking will open it using `winword.exe`. The user will typically also presume that the `.docx` file is safe. \ @@ -1205,7 +1180,7 @@ version = 2 references = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense. narrative = Because attackers often modify system logs to cover their tracks and/or to thwart the investigative process, log monitoring is an industry-recognized best practice. While there are legitimate reasons to manipulate system logs, it is still worthwhile to keep track of who manipulated the logs, when they manipulated them, and in what way they manipulated them (determining which accesses, tools, or utilities were employed). Even if no malicious activity is detected, the knowledge of an attempt to manipulate system logs may be indicative of a broader security risk that should be thoroughly investigated.\ The Analytic Story gives users two different ways to detect manipulation of Windows Event Logs and one way to detect deletion of the Update Sequence Number (USN) Change Journal. The story helps determine the history of the host and the users who have accessed it. Finally, the story aides in investigation by retrieving all the information on the process that caused these events (if the process has been identified). @@ -1217,7 +1192,7 @@ version = 2 references = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment. narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment. @@ -1228,7 +1203,7 @@ version = 2 references = ["https://attack.mitre.org/tactics/TA0004/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more. narrative = Privilege escalation is a "land-and-expand" technique, wherein an adversary gains an initial foothold on a host and then exploits its weaknesses to increase his privileges. The motivation is simple: certain actions on a Windows machine--such as installing software--may require higher-level privileges than those the attacker initially acquired. By increasing his privilege level, the attacker can gain the control required to carry out his malicious ends. This Analytic Story provides searches to detect and investigate behaviors that attackers may use to elevate their privileges in your environment. @@ -1239,7 +1214,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Notable History - Response Task"] description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner. narrative = The Windows operating system uses a services architecture to allow for running code in the background, similar to a UNIX daemon. Attackers will often leverage Windows services for persistence, hiding in plain sight, seeking the ability to run privileged code that can interact with the kernel. In many cases, attackers will create a new service to host their malicious code. Attackers have also been observed modifying unnecessary or unused services to point to their own code, as opposed to what was intended. In these cases, attackers often use tools to create or modify services in ways that are not typical for most environments, providing opportunities for detection. @@ -2062,6 +2037,16 @@ annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.003"], "nist": ["PR. known_false_positives = It is possible that a legitimate user is experiencing an issue causing multiple account login failures leading to lockouts. providing_technologies = [] +[savedsearch://ESCU - Detect Exchange Web Shell - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will have a randomized name of 8 characters long. Review the file for suspect commands. Identify additional log sources, IIS included, to review source and other potential exploitation. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"]} +known_false_positives = The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product. +providing_technologies = [] + [savedsearch://ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule] type = detection asset_type = Network @@ -2169,7 +2154,7 @@ confidence = medium explanation = This search looks for reading loaded Images unique to credential dumping with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon Event Code. how_to_implement = This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 7 with powershell.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.AE", "DE.CM"]} -known_false_positives = Other tools can import the same DLLs. These tools should be part of a whitelist. +known_false_positives = Other tools can import the same DLLs. These tools should be part of a whitelist. False positives may be present with any process that authenticates or uses credentials, PowerShell included. Filter based on parent process. providing_technologies = [] [savedsearch://ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule]